Medium severity · published Aug 28, 2025
CVE-2025-57756
Contao discloses sensitive information in the front end search index
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves disabling the front end search.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 22% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
contao · contao
>= 4.9.14, < 4.13.56; >= 5.0.0-RC1, < 5.3.38; >= 5.4.0-RC1, < 5.6.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-57756
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-57756
Vendor Advisory
https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
Patch
https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
Patch
https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
More from contao
9.8
CVE-2022-26265
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter
9.8
CVE-2019-11512
Contao 4.x allows SQL Injection
9.3
CVE-2026-107845
Contao: Cross-site scripting in the comments bundle
8.8
CVE-2024-45398
Contao is an Open Source CMS
8.8
CVE-2012-4383
contao prior to 2.11.4 has a sql injection vulnerability