Contao Comments Bundle Critical Stored XSS in Backend Metadata Fields

The Contao CMS comments-bundle contains a critical stored cross-site scripting flaw identified as CVE-2026-107845. According to the National Vulnerability Database, the issue allows unauthenticated visitors to inject malicious scripts through comment metadata fields. These scripts execute in the backend environment when authorized users review the comments, bypassing standard separation between frontend input and administrative interfaces.

Root cause

The vulnerability stems from insufficient attribute and URL encoding within the listComments() function in comments-bundle/contao/dca/tl_comments.php. When the system renders comment data for backend users, it fails to properly sanitize the email and website metadata fields. This lack of encoding allows attacker-controlled HTML or JavaScript to persist in the database and render as active code within the administrative panel.

Attack path

An unauthenticated visitor submits a comment containing malicious payloads in the email or website fields. The payload remains stored in the database even if the comment is unpublished. When a backend user opens the Comments module to moderate or review entries, the browser executes the script under that user's session. This execution occurs without any click or hover interaction from the administrator, facilitating immediate compromise of the backend session.

Affected versions

• Contao CMS versions 4.0.0 through 5.3.49 are vulnerable to this stored XSS attack.
• Contao CMS versions 5.4.0-RC1 through 5.7.11 are also affected by the same encoding flaw.
• The issue is resolved in patched releases 5.3.50 and 5.7.12 for the comments-bundle package.

Mitigation

• Upgrade the Contao CMS installation to version 5.3.50 or 5.7.12 to apply the official vendor fix.
• Ensure the composer package contao/comments-bundle is updated to the patched version corresponding to your major release line.
• Verify that the backend interface does not render untrusted input without proper encoding by testing with benign payloads before upgrading.

What to do and how to stay safe: Contao CMS

• Audit your Contao CMS version immediately to determine if you are running a vulnerable release below 5.3.50 or 5.7.12.
• Monitor backend administrative sessions for unexpected actions or new user creations that could indicate successful exploitation of this flaw.
• Implement strict input validation on frontend comment forms to reject malformed data, though this does not replace the need for server-side encoding fixes.
• Once the vendor provides an update, apply it promptly to close the window where unauthenticated users can inject executable code into the backend.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does comment moderation prevent this XSS vulnerability from being exploited?

No, moderation does not prevent exposure because unpublished comments remain visible to moderators, who must open the list to act on them.

What specific fields in the comment form are vulnerable?

The email and website metadata fields in the comment submission form are vulnerable due to insufficient encoding during backend rendering.

Is there a Content-Security-Policy header mitigating this issue?

No, the Contao backend does not send a Content-Security-Policy header, so nothing mitigates the inline script handler execution.