Description

Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.

Remediation

References

CVE-2025-29790

Related Vulnerabilities

Drupal Core 9.1.x Cross-Site Scripting (9.1.0 - 9.1.11)

WordPress Plugin Super Store Finder for WordPress (Google Maps Store Locator) Arbitrary File Upload (6.1)

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-4554)

WordPress Plugin Video Conferencing with Zoom Cross-Site Scripting (3.8.15)

ReviveAdserver Use of Externally-Controlled Format String Vulnerability (CVE-2025-52666)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2025-29790