Contao: Cross-site scripting in the comments bundle (CVE-2026-107845)

The Contao comments bundle contains a stored cross-site scripting vulnerability (CVE-2026-107845) that permits an unauthenticated visitor to submit a comment with malicious script code. When a back end user opens the Comments module, the injected script executes automatically in their session context due to the absence of Content-Security-Policy headers. This allows the attacker to perform actions with the privileges of the back end user, including reading accessible modules, creating new administrators, or modifying templates that can lead to remote code execution. Moderation does not mitigate the issue because unpublished comments are still rendered, ensuring exposure. The vulnerability affects Contao versions >=4.0.0 <5.3.50 and >=5.4.0-RC1 <5.7.12. A patch is available to remediate this critical security flaw.

An attacker can inject malicious scripts via comments that execute in the browser of any back end user who views the Comments module, without requiring any interaction. This results in full compromise of the back end user session, allowing the attacker to read data, create new administrators, or modify templates to achieve code execution. The vulnerability effectively allows remote code execution through the back end interface. Moderation does not prevent exploitation and actually ensures exposure of the malicious payload to back end users.

A patch is available for this vulnerability and should be applied promptly. Since the vulnerability is in the Contao comments bundle and affects specific versions, upgrading to a fixed version is the recommended remediation. There is no indication that Content-Security-Policy headers are currently implemented, so relying on such mitigations is insufficient. Moderation does not prevent exploitation and should not be relied upon as a mitigation.