CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No Content-Security-Policy header is sent on the Contao back end, so nothing mitigates the inline handler.
- No known exploitation
- Severity
- Critical, CVSS 9.3 (v3.1)
- EPSS
- 0.27% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- contao/comments-bundle (composer) >= 4.0.0, < 5.3.50, fixed in 5.3.50 · GHSA-628f-v4f6-p37r
- contao/comments-bundle (composer) >= 5.4.0-RC1, < 5.7.12, fixed in 5.7.12 · GHSA-628f-v4f6-p37r