CVE-2025-29790
Fixed upstream EPSS <1%CVSS 4.8
Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.
Products: contao
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | contao/core-bundle | 4.13.54 |
| Packagist | contao/core-bundle | 5.3.30 |
| Packagist | contao/core-bundle | 5.5.6 |