CVE-2025-57756: Contao CMS Information Disclosure Flaw

CVE-2025-57756 Overview

CVE-2025-57756 is an information disclosure vulnerability in Contao, an open source content management system (CMS). Protected content elements rendered as fragments are indexed by the front end search and become publicly available. The flaw affects Contao versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1. The issue is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. An unauthenticated remote attacker can query the front end search to retrieve content that should only be visible to authorized member groups.

Critical Impact
Unauthenticated attackers can retrieve protected content indexed by the Contao front end search, exposing information intended only for restricted member groups.

Affected Products

Contao CMS versions 4.9.14 through 4.13.55
Contao CMS versions 5.0.0 through 5.3.37
Contao CMS versions 5.4.0 through 5.6.0

Discovery Timeline

2025-08-28 - CVE-2025-57756 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57756

Vulnerability Analysis

Contao renders content elements as fragments through the Controller class in the core-bundle. The front end search indexer respects an indexer::stop directive to skip protected content. The vulnerability stems from an incorrect object reference when the indexer evaluates whether a fragment is protected. The code checked the protection state on the wrong object, causing protected fragments to be indexed alongside public content.

An unauthenticated attacker can query the front end search interface and retrieve snippets or entire text of protected articles, news entries, or other fragment-rendered elements. This exposes content restricted to logged-in members or specific member groups without requiring credentials.

Root Cause

The fix in commit a03976c in core-bundle/contao/library/Contao/Controller.php shows the root cause. The indexer read the protected flag and groups property from $objModule rather than from the actual content row $objRow. Fragments therefore inherited the module's protection state instead of the element's own state, allowing protected fragment content past the indexer stop guard.

Attack Vector

An attacker sends search queries to a public Contao site. Matching protected fragments return in results with their indexed text. No authentication, user interaction, or elevated privileges are required. Exploitation is limited to confidentiality; the flaw does not enable modification or availability impact.

php

// Security patch in core-bundle/contao/library/Contao/Controller.php
// Source: https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514

		// Disable indexing if protected
-		if ($objModule->protected && !preg_match('/^\s*<!-- indexer::stop/', $strBuffer))
+		if ($objRow->protected && !preg_match('/^\s*<!-- indexer::stop/', $strBuffer))
 		{
-			$groups = StringUtil::deserialize($objModule->groups, true);
+			$groups = StringUtil::deserialize($objRow->groups, true);

 			if (\count($groups) !== 1 || !\in_array(-1, array_map(\intval(...), $groups), true))
 			{

The patch changes the object read by the protection check from $objModule to $objRow, ensuring the fragment's own protection flag and group assignment are enforced before indexing.

Detection Methods for CVE-2025-57756

Indicators of Compromise

Search result pages returning excerpts from URLs configured with protected=1 in the tl_page or tl_article tables.
Access logs showing high-volume GET requests to the front end search endpoint from a single client.
Presence of protected fragment URLs in the tl_search and tl_search_index database tables.

Detection Strategies

Audit the Contao search index tables (tl_search, tl_search_index) and cross-reference indexed URLs against pages or articles flagged protected.
Review web server access logs for anonymous requests that returned content matching protected article identifiers.
Compare installed Contao versions across environments to identify hosts running versions between 4.9.14 and the patched releases.

Monitoring Recommendations

Log and alert on repeated queries to /search.html or custom search routes returning non-empty results without an authenticated session cookie.
Track composer package updates so that contao/core-bundle and contao/contao remain on 4.13.56, 5.3.38, or 5.6.1 or later.
Monitor outbound HTTP responses containing text originally tagged as member-restricted content.

How to Mitigate CVE-2025-57756

Immediate Actions Required

Upgrade Contao to version 4.13.56, 5.3.38, or 5.6.1 depending on the installed major release.
After patching, purge and rebuild the front end search index to remove previously indexed protected content.
Review the search index for any protected fragment URLs and remove them manually if a rebuild is not immediate.

Patch Information

The fix is available in Contao 4.13.56, 5.3.38, and 5.6.1. It is delivered by commit a03976c459b6f3985a28f6488b82a76ffb6c0514 in the contao/contao repository. See the Contao Security Advisory and GitHub Security Advisory GHSA-2xmj-8wmq-7475 for release details.

Workarounds

Disable the front end search module entirely until the upgrade can be applied.
Wrap protected fragment templates with the  and  markers to prevent indexing.
Restrict search endpoints to authenticated members via web server or firewall rules while patching is pending.

bash

# Upgrade Contao via Composer to a patched release
composer require contao/contao:^5.6.1
# For 5.3.x branch
composer require contao/contao:^5.3.38
# For 4.13.x branch
composer require contao/contao:^4.13.56

# Rebuild the search index after upgrade
vendor/bin/contao-console contao:search:index --clear