critical · 9.3 Patched

Contao: Cross-site scripting in the comments bundle

CVE-2026-107845 · GHSA-628f-v4f6-p37r · published 9 Oct 2026

How serious is it

  • Severity: critical, CVSS score 9.3 out of 10.
  • No exploit prediction (EPSS) score yet.
  • Not on the CISA list of exploited vulnerabilities.
  • No public exploit in Exploit-DB.

Is your app affected by CVE-2026-107845?

Paste this prompt into Claude Code, Cursor or any AI coding tool: it runs a free Shippable scan of your project and fixes what it finds. Built with Lovable, Bolt or v0? Scan your live app. Or upload your package file.

Who is affected

  • contao/comments-bundle (Packagist) >= 4.0.0, < 5.3.50
  • contao/comments-bundle (Packagist) >= 5.4.0-RC1, < 5.7.12

How to check

  1. Run composer show contao/comments-bundle in your project to see the installed version, including copies pulled in by other packages.
  2. Or paste your lockfile into the checker: it lists every package with a known vulnerability, this one included.

How to fix

Copies a prompt for Claude Code, Cursor or Codex: it checks your lockfiles for this and upgrades it.
  1. On >= 4.0.0, < 5.3.50: Upgrade contao/comments-bundle to 5.3.50 or later, commit the lockfile and redeploy.
  2. On >= 5.4.0-RC1, < 5.7.12: Upgrade contao/comments-bundle to 5.7.12 or later, commit the lockfile and redeploy.
  3. If a vulnerable version was live, check your logs and rotate the secrets that server could read.

The advisory

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No `Content-Security-Policy` header is sent on the Contao back end, so nothing mitigates the inline handler. ### Impact Anyone on the internet can inject script that executes in the Contao back end origin, under the session of whichever user opens the Comments module, with no click and no hover. From there the payload acts as that user through the back end: reading any module they can reach, creating a new administrator, or editing a template, which on Contao is a documented path from back end write access to code execution. Moderation does not help and in fact guarantees exposure, since unpublished comments are still inserted and a moderator has to open the list to act on them.

Check your whole app

Dependencies are only half of it. Free and read-only: before you push, run npx shippable-dev scan localhost:3000 in your project folder, no account needed. For your live app, you prove it's yours with a one-line tag first.

References

Merged from GitHub Advisory Database. Last updated 23 Oct 2026. All vulnerabilities · RSS · JSON

Get alerts for new exploited vulnerabilities