CVE-2025-29790: Contao allows cross-site scripting through SVG uploads

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-18 · updated 2026-06-17
Weakness: CWE-79

Description

Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.

Affected products

contao: from 4.0.0 before 4.13.53; from 5.0.0 before 5.3.30; from 5.4.0 before 5.5.6 — fixed in 4.13.53, 5.3.30, 5.5.6

How to fix

Upgrade to a fixed version: contao 4.13.53, 5.3.30, 5.5.6. Check the vendor advisory for mitigations.

References

https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads
https://github.com/contao/contao/security/advisories/GHSA-vqqr-fgmh-f626

Get alerted when CVE-2025-29790 or the next vulnerability affects your stack