Skip to main content
Stopping PHP2SHELL: How SentinelOne Protects Customers From This Attack TechniqueRead More
Vulnerability Database/CVE-2026-107845

CVE-2026-107845: Contao CMS XSS Vulnerability

CVE-2026-107845 is a cross-site scripting flaw in Contao CMS that allows unauthenticated attackers to execute malicious scripts in the backend. This post explains its impact, affected versions, and mitigation steps.

Published:

CVE-2026-107845 Overview

CVE-2026-107845 is a stored cross-site scripting (XSS) vulnerability in Contao, an open source content management system (CMS). The flaw exists in the listComments() function within comments-bundle/contao/dca/tl_comments.php. An unauthenticated visitor can submit a comment with crafted email or website metadata. When a backend moderator opens the Comments module, the attacker-controlled payload executes in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation workflows do not prevent exposure. The issue affects versions 4.0.0 through 5.3.49 and 5.7.11, and is fixed in 5.3.50 and 5.7.12.

Critical Impact

Unauthenticated attackers can execute arbitrary JavaScript in a backend moderator's authenticated session, enabling account takeover and backend compromise.

Affected Products

  • Contao CMS versions 4.0.0 through 5.3.49
  • Contao CMS 5.7.0 through 5.7.11
  • Contao comments-bundle package

Discovery Timeline

  • 2026-10-09 - CVE-2026-107845 published to NVD
  • 2026-10-16 - Last updated in NVD database

Technical Details for CVE-2026-107845

Vulnerability Analysis

The vulnerability is a stored XSS flaw [CWE-79] in the Contao backend Comments module. The listComments() function renders user-submitted comment metadata into HTML attributes without sufficient encoding. Specifically, the email field is passed through Idna::decodeEmail() and placed directly into an href="mailto:..." attribute. The website field is also inserted into an href attribute without URL encoding. Both sinks accept attacker-controlled strings submitted through the public comment form. Because moderators review unpublished comments, the payload fires before a human approves the content. The attacker needs no credentials to inject the payload, but a backend user must open the Comments module to trigger execution.

Root Cause

The root cause is missing output encoding for untrusted input placed inside HTML attributes. The pre-patch code concatenates Idna::decodeEmail($arrRow['email']) and $arrRow['website'] into href attributes without applying StringUtil::specialchars() or StringUtil::specialcharsUrl(). An attacker can break out of the attribute context using quote characters or inject javascript: URLs through the website field.

Attack Vector

An unauthenticated remote attacker submits a comment on any Contao site with the comments bundle enabled. The attacker populates the email or website field with a payload designed to escape the HTML attribute context. When a moderator later opens the Comments module in the Contao backend, the browser renders the attribute and executes the script in the backend origin. The script runs with the moderator's session cookies and can perform any action available to that user.

php
// Pre-patch (vulnerable) vs post-patch rendering in listComments()
// Source: https://github.com/contao/contao/commit/22505d5f79bc1a7f52e2cba5fddf6007e1f0408a

// BEFORE (vulnerable): email and website rendered without attribute/URL encoding
'<div class="cte_type ' . $key . '"><a href="mailto:' . Idna::decodeEmail($arrRow['email']) . '" title="' . StringUtil::specialchars(Idna::decodeEmail($arrRow['email'])) . '">' . $arrRow['name'] . '</a>' . ($arrRow['website'] ? ' (<a href="' . $arrRow['website'] . '" title="' . StringUtil::specialchars($arrRow['website']) . '" target="_blank" rel="noreferrer noopener">' . $GLOBALS['TL_LANG']['MSC']['com_website'] . '</a>)' : '')

// AFTER (patched): specialchars() wraps email href, specialcharsUrl() sanitizes website href
'<div class="cte_type ' . $key . '"><a href="mailto:' . StringUtil::specialchars(Idna::decodeEmail($arrRow['email'])) . '" title="' . StringUtil::specialchars(Idna::decodeEmail($arrRow['email'])) . '">' . $arrRow['name'] . '</a>' . ($arrRow['website'] ? ' (<a href="' . StringUtil::specialcharsUrl($arrRow['website']) . '" title="' . StringUtil::specialchars($arrRow['website']) . '" target="_blank" rel="noreferrer noopener">' . $GLOBALS['TL_LANG']['MSC']['com_website'] . '</a>)' : '')

Source: GitHub Commit 22505d5

Detection Methods for CVE-2026-107845

Indicators of Compromise

  • Comment records in tl_comments whose email or website columns contain characters such as ", <, >, or javascript: schemes
  • Backend sessions issuing unexpected administrative requests shortly after a moderator opens the Comments module
  • Outbound requests from backend users' browsers to attacker-controlled domains referenced in comment metadata

Detection Strategies

  • Query the tl_comments table for rows where website does not match a strict URL pattern or where email contains HTML control characters
  • Review web server access logs for POST requests to the comment submission endpoint with suspicious payloads in email or website parameters
  • Correlate backend /contao requests with preceding visits to the Comments module to identify session abuse

Monitoring Recommendations

  • Enable Content Security Policy (CSP) reporting on the Contao backend to surface inline script execution attempts
  • Monitor for new or modified backend user accounts, permission changes, and file manager activity following Comments module access
  • Alert on bulk comment submissions from a single IP containing non-standard characters in metadata fields

How to Mitigate CVE-2026-107845

Immediate Actions Required

  • Upgrade Contao to version 5.3.50 or 5.7.12 immediately
  • Audit existing tl_comments records and delete or sanitize entries containing suspicious email or website values
  • Rotate backend user session cookies and reset passwords for moderators who accessed the Comments module before patching

Patch Information

The fix is published in Contao releases 5.3.50 and 5.7.12. The patch wraps the email href with StringUtil::specialchars() and routes the website URL through StringUtil::specialcharsUrl() in comments-bundle/contao/dca/tl_comments.php. Full technical details are documented in GitHub Security Advisory GHSA-628f-v4f6-p37r.

Workarounds

  • Disable the comments bundle until the upgrade is applied by removing or deactivating contao/comments-bundle in Composer
  • Restrict backend access to the Comments module by removing the module permission from moderator user groups
  • Deploy a web application firewall (WAF) rule to block comment submissions containing ", <, or javascript: in email or website fields
bash
# Upgrade Contao via Composer to a patched release
composer require contao/contao-manager-bundle:^5.3.50 --update-with-dependencies
# or for the 5.7 branch
composer require contao/contao-manager-bundle:^5.7.12 --update-with-dependencies

# Verify installed version
vendor/bin/contao-console contao:version

Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.

Experience the Most Advanced Cybersecurity Platform

See how the world’s most intelligent, autonomous cybersecurity platform can protect your organization today and into the future.

Try SentinelOne