Contao closes six vulnerabilities, 6.0 can still wait

Six advisories, two patch releases

The fixes are in Contao 5.3.50 and 5.7.12. Both are patch releases within their respective minor line, so installing them is comparatively low risk. The range of affected versions is wider than in most earlier waves. Two of the vulnerabilities go back as far as Contao 4.0.

The most serious one is a privilege escalation in the back end. Regular users with access to the user module can grant themselves permissions that effectively make them administrators. Affected are 5.0 to 5.2, 5.3 up to 5.3.49, 5.4 to 5.6 and 5.7 up to 5.7.11.

The cross-site scripting issue in the comments bundle can be exploited without any account at all. The code is injected through front end comments and later executed in the back end. On top of that come an XSS flaw in the front end search results, insufficient access controls in the CSV import wizard and in the preview links module, plus a data protection issue around the search index. If the index is left in place after indexing of protected pages is switched off, protected hits keep showing up in the front end search. CVE numbers and CVSS scores are still missing, the advisory pages show a placeholder. There is no evidence of public exploitation for any of the six issues.

The most critical gap depends on your configuration

The privilege escalation only bites where ordinary editorial accounts have access to the user and user group modules. In agency projects that have grown over the years this is often exactly how things are set up, because the client wanted to create their own editors. Review that permission after the update as well and revoke it wherever it is not needed.

For the search index, the update on its own is not enough. The index has to be cleared and rebuilt, otherwise the old hits stay visible. This affects member areas, internal documents and price lists behind access protection.

Instances on Contao 4.13 and 5.6 have received no updates since 18 February 2026. These vulnerabilities stay open there. Treat such systems as permanently unpatched and put a date for the move to 5.7 into your planning.

Contao 6.0 is available, but not a base for production

Contao 6.0.0 was released on 26 August 2026. It requires PHP 8.4 and runs on Symfony 7.4 and 8. The central change is the switch from input to output encoding, together with the completion of the move to Twig. According to the core team, the release brings hardly any visible new features.

As an interim release, 6.0 has only around six months of support. At the same time, the encoding change is exactly the kind of change that breaks custom templates and older extensions. For production client projects, 5.7 LTS remains the choice, with security updates until 14 February 2030. Contao 5.3 gets bug fixes until 14 February 2027 and security updates until 14 February 2028, so there is no emergency pressure.

A test system running 6.0 is worth setting up. It shows which extensions and templates stumble under output encoding. That makes the move to the next LTS, 6.3, planned for February 2028, easier to schedule.

What this means for your installations

An update is due, whatever the size of the project. The order matters, because two of the steps go beyond simply installing the release. Towards clients, this can be framed as a scheduled batch fix carried out promptly.

Think ahead on hosting. Contao 5.7 requires PHP 8.3, Contao 6.0 requires PHP 8.4. With shared hosting on a fixed PHP version, clarify this before the major upgrade. The same applies to local development environments on the Mac, as a 6.0 project cannot be set up without PHP 8.4 in Homebrew, DDEV or Herd.

• Build an inventory of all managed instances with their exact patch version.

• Update 5.7.x to 5.7.12 and 5.3.x to 5.3.50.

• Clear and re-crawl the search index on every site with protected pages.

• Revoke access to the user and user group modules for regular editorial accounts.

• Switch off front end comments wherever nobody uses them anyway.

• Start new projects on 5.7 LTS, but buy hosting that already supports PHP 8.4.