CVE-2026-107845: Contao: Cross-site scripting in the comments bundle
An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No Content-Security-Policy header is sent on the Contao back end, so nothing mitigates the inline handler.
References
- github.com/advisories/GHSA-628f-v4f6-p37r
- github.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408a
- github.com/contao/contao/releases/tag/5.3.50
- github.com/contao/contao/releases/tag/5.7.12
- github.com/contao/contao/security/advisories/GHSA-628f-v4f6-p37r
- nvd.nist.gov/vuln/detail/CVE-2026-107845
Code Behaviors & Features
Detect and mitigate CVE-2026-107845 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →