Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-9fgc-p6aq-vygh
Vulnerability ID VCID-9fgc-p6aq-vygh
Aliases CVE-2025-57756
GHSA-2xmj-8wmq-7475
Summary Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. A workaround involves disabling the front end search.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-612 Improper Authorization of Index Containing Sensitive Information
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00066 https://api.first.org/data/v1/epss?cve=CVE-2025-57756
epss 0.00066 https://api.first.org/data/v1/epss?cve=CVE-2025-57756
cvssv3.1 5.3 https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
generic_textual MODERATE https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
ssvc Track https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
cvssv3.1 5.3 https://github.com/contao/contao
generic_textual MODERATE https://github.com/contao/contao
cvssv3.1 5.3 https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
generic_textual MODERATE https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
ssvc Track https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
cvssv3.1 5.3 https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
generic_textual MODERATE https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
ssvc Track https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2025-57756
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-57756
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-57756
https://github.com/contao/contao
https://nvd.nist.gov/vuln/detail/CVE-2025-57756
a03976c459b6f3985a28f6488b82a76ffb6c0514 https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
GHSA-2xmj-8wmq-7475 https://github.com/advisories/GHSA-2xmj-8wmq-7475
GHSA-2xmj-8wmq-7475 https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
information-disclosure-in-the-front-end-search-index https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-28T17:49:20Z/ Found at https://contao.org/en/security-advisories/information-disclosure-in-the-front-end-search-index
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-28T17:49:20Z/ Found at https://github.com/contao/contao/commit/a03976c459b6f3985a28f6488b82a76ffb6c0514
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-08-28T17:49:20Z/ Found at https://github.com/contao/contao/security/advisories/GHSA-2xmj-8wmq-7475
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-57756
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.20744
EPSS Score 0.00066
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:14:40.263652+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/57xxx/CVE-2025-57756.json 38.6.0