CVE-2025-57757: Contao CMS Information Disclosure Flaw

CVE-2025-57757 Overview

CVE-2025-57757 is an information disclosure vulnerability in Contao, an open source content management system (CMS). The flaw affects the news module in Contao versions 5.0.0 through 5.3.37 and 5.6.0. When a news feed includes protected news archives, the module fails to filter news items belonging to those archives. As a result, protected news items become publicly accessible through the RSS feed. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Contao has released fixed versions 5.3.38 and 5.6.1.

Critical Impact
Protected news content intended for authenticated users is exposed through RSS feeds without any authentication, allowing unauthenticated remote attackers to read restricted content.

Affected Products

Contao CMS versions 5.0.0 through 5.3.37
Contao CMS version 5.6.0
Contao news-bundle component (contao:contao)

Discovery Timeline

2025-08-28 - CVE-2025-57757 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-57757

Vulnerability Analysis

The vulnerability resides in the Contao news feed generation logic within the news-bundle component. Contao supports news archives that can be marked as protected, restricting their visibility to authenticated users with specific frontend group memberships. The RSS feed generator iterates over configured archives and emits their items, but it does not evaluate the protection settings of each archive before including its news items in the feed output.

An unauthenticated remote attacker who knows or discovers the URL of a news feed page can retrieve the RSS output and read the titles, teasers, and full content of protected news items. This defeats the frontend access control model applied elsewhere in Contao. The exposure is limited to content confidentiality — integrity and availability are unaffected.

Root Cause

The NewsFeedListener event listener responsible for fetching articles for the feed did not enforce the ContaoCorePermissions check against NewsArchiveModel protection metadata. Feed rendering paths bypassed the authorization decision applied to standard frontend rendering.

Attack Vector

Exploitation requires only network access to a vulnerable Contao site whose news feed page is configured to include at least one protected news archive. The attacker issues a standard HTTP GET request to the RSS feed endpoint and parses the returned XML for protected content.

php

 use Contao\CoreBundle\Image\ImageFactoryInterface;
 use Contao\CoreBundle\InsertTag\InsertTagParser;
 use Contao\CoreBundle\Routing\ContentUrlGenerator;
+use Contao\CoreBundle\Security\ContaoCorePermissions;
 use Contao\Environment;
 use Contao\File;
 use Contao\FilesModel;
+use Contao\NewsArchiveModel;
 use Contao\NewsBundle\Event\FetchArticlesForFeedEvent;
 use Contao\NewsBundle\Event\TransformArticleForFeedEvent;
 use Contao\NewsModel;

Source: Contao patch commit e75f46b. The patch imports ContaoCorePermissions and NewsArchiveModel into NewsFeedListener.php so the listener can evaluate archive protection before emitting items into the feed.

Detection Methods for CVE-2025-57757

Indicators of Compromise

Anonymous HTTP GET requests to Contao RSS feed endpoints (typically ending in .xml or /share/*) returning content that references protected articles.
Unusual volumes of feed requests from single source IPs or automated user agents targeting /share/ or feed URLs.
Presence of protected news archive titles or slugs in cached or indexed public feed output.

Detection Strategies

Compare content served by the RSS feed against the list of protected news archives in the Contao backend and flag any overlap.
Review web server access logs for successful 200 responses to feed URLs by unauthenticated clients when protected archives are configured.
Inspect search engine indexes and third-party feed aggregators for protected article titles that should not be publicly reachable.

Monitoring Recommendations

Enable request logging on the reverse proxy or web server in front of Contao and retain logs for feed URLs.
Track the installed Contao version across all managed sites and alert when versions below 5.3.38 or 5.6.1 are detected.
Monitor Contao security advisories at the Contao Security Advisories page for follow-up guidance.

How to Mitigate CVE-2025-57757

Immediate Actions Required

Upgrade Contao to version 5.3.38 or 5.6.1 using Composer as soon as possible.
Audit every news feed page in the Contao backend and identify feeds that include protected news archives.
If patching is not immediately possible, remove protected news archives from all news feed page configurations.
Rotate or invalidate any content assumed to be confidential that may have been exposed via public feeds.

Patch Information

Contao maintainers released fixed versions 5.3.38 and 5.6.1. The fix is implemented in commit e75f46b11974fbf7a4652e65c19ad6ca84c59271 and documented in GitHub Security Advisory GHSA-w53m-gxvg-vx7p. The patch adds ContaoCorePermissions and NewsArchiveModel checks to the NewsFeedListener so that items from protected archives are filtered out before feed rendering.

Workarounds

Do not add protected news archives to any news feed page until the upgrade is completed.
Restrict access to feed URLs at the web server level using IP allow-lists or authentication where feasible.
Temporarily disable the affected news feed pages if they cannot be reconfigured immediately.

bash

# Upgrade Contao via Composer to a patched release
composer require contao/contao-bundle:^5.3.38
# or, for the 5.6 branch
composer require contao/contao-bundle:^5.6.1
composer update contao/*
bin/console cache:clear --env=prod