Loading vulnerability…
Stored XSS in Contao Comments Backend
CVE-2026-107845 is a stored cross-site scripting vulnerability in Contao CMS's comments bundle. The listComments() function renders comment email and website metadata without sufficient HTML attribute and URL encoding. An unauthenticated visitor can submit malicious metadata that executes automatically in the Contao backend origin under a backend user's session when that user opens the Comments module. Unpublished comments also expose moderators. Affected releases begin with version 4.0.0; the applicable fixed releases are 5.3.50 and 5.7.12.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Injected JavaScript executes with the viewing backend user's session without requiring clicking or hovering over the malicious comment. Depending on that user's permissions, exploitation can expose information in accessible modules, permit creation of an administrator account, or allow template modification that could lead to code execution. Comment publication is unnecessary because unpublished comments remain visible to moderators.
If you can’t patch tonight, do this now.
Comment moderation and withholding publication do not prevent exploitation because unpublished comments remain in the backend list. The backend does not send a Content-Security-Policy header that mitigates the inline handler. No effective interim workaround is specified.
Patch, then assume compromise.
Upgrade contao/comments-bundle and related packages to the applicable fixed release or a later supported release: 5.3.50 for the affected range beginning at 4.0.0, or 5.7.12 for the affected range beginning at 5.4.0-RC1.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.