CVE-2025-65960 Overview
CVE-2025-65960 is a remote code execution vulnerability in Contao, an open source content management system (CMS) written in PHP. Back end users who can precisely control the contents of template closures can execute arbitrary PHP functions that do not require parameters. The flaw affects Contao versions from 4.0.0 up to 4.13.57, 5.3.42, and 5.6.5. Contao maintainers released patches in versions 4.13.57, 5.3.42, and 5.6.5. The weakness is classified under [CWE-351] (Insufficient Type Distinction).
Critical Impact
Authenticated back end users can invoke arbitrary parameterless PHP functions through crafted template closures, leading to remote code execution on the underlying web server.
Affected Products
- Contao CMS versions 4.0.0 through 4.13.56
- Contao CMS versions 5.0.0 through 5.3.41
- Contao CMS versions 5.4.0 through 5.6.4
Discovery Timeline
- 2025-11-25 - CVE-2025-65960 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-65960
Vulnerability Analysis
Contao renders templates through PHP objects, and the Contao\Template::once() method processes closures used inside templates. The method does not adequately distinguish between safe callable values and attacker-controlled callable representations. An authenticated back end user with granular control over template closure contents can supply a value that Contao interprets as a callable and invokes as a PHP function.
Because the invocation path does not pass arguments, exploitation is limited to PHP functions that accept zero required parameters. Many built-in and application-defined functions in that category still provide meaningful primitives, including information disclosure and command execution helpers.
Root Cause
The root cause is insufficient type distinction ([CWE-351]) inside the template closure handling logic in Contao\Template::once(). Data influenced by back end input reaches a code path that treats strings or arrays as PHP callables without validating that the target is an intended closure. This confusion between data and executable references enables arbitrary function invocation within the PHP process serving the CMS.
Attack Vector
Exploitation requires an authenticated back end account with permission to edit or influence template content. The attacker crafts a template that submits a callable expression through the closure mechanism. When the template is rendered, Contao invokes the callable, executing the referenced PHP function inside the web application context. The attack occurs over the network against the Contao administrative interface and does not require user interaction.
No public proof-of-concept, exploit code, or CISA Known Exploited Vulnerabilities (KEV) listing has been published for CVE-2025-65960. See the Contao Remote Code Execution Advisory and GitHub Security Advisory GHSA-98vj-mm79-v77r for vendor technical details.
Detection Methods for CVE-2025-65960
Indicators of Compromise
- Unexpected modifications to Contao template files or database-backed template records made by back end users.
- PHP error logs referencing Contao\Template::once() with unusual callable values.
- Web server processes spawning shell utilities, network tools, or file-write operations originating from the Contao application user.
- Outbound network connections initiated by the PHP-FPM or web server worker after template rendering events.
Detection Strategies
- Audit Contao back end user activity for template edits, particularly by non-administrative accounts with elevated template permissions.
- Review installed Contao version against fixed releases 4.13.57, 5.3.42, and 5.6.5, and flag hosts running vulnerable builds.
- Correlate template rendering events with subsequent process execution to identify anomalous parent-child process chains on the web server.
Monitoring Recommendations
- Enable and centralize Contao back end audit logs, including template create, update, and delete actions.
- Ship web server, PHP-FPM, and host process telemetry to a centralized analytics platform for correlation across template edits and process launches.
- Alert on invocations of sensitive PHP functions such as phpinfo, posix_getpwuid, or application-defined parameterless helpers from within template rendering paths.
How to Mitigate CVE-2025-65960
Immediate Actions Required
- Upgrade Contao to 4.13.57, 5.3.42, or 5.6.5 depending on the branch in use.
- Review back end user accounts and revoke template editing privileges from users that do not require them.
- Rotate credentials for back end accounts that had template editing permissions during the vulnerable window.
- Inspect existing templates and template database records for unexpected closure content prior to upgrading.
Patch Information
Contao maintainers fixed the issue in versions 4.13.57, 5.3.42, and 5.6.5. Administrators should apply the vendor patches through Composer or their standard Contao update process. Refer to the Contao Remote Code Execution Advisory and GitHub Security Advisory GHSA-98vj-mm79-v77r for release notes and upgrade guidance.
Workarounds
- Manually patch the Contao\Template::once() method as described in the vendor advisory when an immediate upgrade is not feasible.
- Restrict back end access to trusted administrators until patches are applied.
- Place the Contao back end behind a network access control, such as an IP allow list or VPN, to reduce the exposed attack surface.
# Upgrade Contao using Composer to a fixed release
composer require contao/manager-bundle:^5.6.5 --update-with-all-dependencies
# Or, for the 5.3 branch
composer require contao/manager-bundle:^5.3.42 --update-with-all-dependencies
# Or, for the 4.13 branch
composer require contao/manager-bundle:^4.13.57 --update-with-all-dependencies
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
