CVE-2026-107845

Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.

• CWE-79
• CWE-116

• https://github.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408a
• https://github.com/contao/contao/releases/tag/5.3.50
• https://github.com/contao/contao/releases/tag/5.7.12
• https://github.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37r

Published

Oct 9, 2026

Last Modified

Oct 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-107839ageLANServer provides a cross-platform web server and launch…7.5
• CVE-2026-107840yopass is a service for securely sharing secrets, passwords,…7.5
• CVE-2026-107841pacioli provides least-privilege governance and a governed a…5.7
• CVE-2026-107842Contao is an Open Source CMS. From version 4.0.0 until 5.3.5…5.3
• CVE-2026-107843Contao is an Open Source CMS. From version 4.1.0 until 5.3.5…5.3
• CVE-2026-107844Contao is an Open Source CMS. From version 5.0.0 until 5.3.5…5.3
• CVE-2026-10786Improper access control in the ticketing integration setting…6.5
• CVE-2026-10787Missing authorization in the deleted user groups API in Devo…4.3
• CVE-2026-107885OpenPrinting CUPS through 2.4.20 contains a resource-exhaust…3.3
• CVE-2026-107886OpenPrinting CUPS before 2.4.20 contains a double-free in pr…2.3
• CVE-2026-107888OpenPrinting CUPS before 2.4.20 contains a NULL pointer dere…5.1
• CVE-2026-107889A flaw was found in the login theme rendering component of K…5.5