CVE-2026-107845

Summary

A stored cross-site scripting (XSS) vulnerability exists in Contao CMS where unauthenticated users can submit comments containing malicious scripts that execute in the backend context when moderators view them. This allows attackers to hijack moderator sessions and potentially gain full administrative access.

Exploitability

Easy to exploit with no prerequisites - attackers simply need to submit a comment with malicious script in email or website fields, which then executes when backend users view the comments module.

Blast radius

High impact in environments where moderators regularly review comments, as attackers can execute arbitrary code in the context of high-privilege backend sessions and potentially escalate to full system compromise.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 5.3.50 or 5.7.12 immediately to patch the XSS vulnerability in comments-bundle/contao/dca/tl_comments.php.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.