Contao CMS Critical Unauthenticated RCE in Comments Bundle Exposes Admins to Script Injection

A critical stored cross-site scripting vulnerability in Contao CMS allows unauthenticated attackers to execute arbitrary scripts within the backend environment. According to the National Vulnerability Database record for CVE-2026-107845, the flaw exists in the comments-bundle component. The issue permits an attacker to submit a comment with malicious metadata that renders without proper encoding. When a backend user views the comment list, the script executes under that user’s session.

The risk

The vulnerability stems from insufficient attribute and URL encoding in the listComments() function within tl_comments.php. An unauthenticated front-end visitor can post a comment containing an XSS injection payload in the email or website metadata fields. The GitHub advisory GHSA-628f-v4f6-p37r notes that no Content-Security-Policy header is sent on the Contao backend. This absence means nothing mitigates the inline handler triggered by the malicious input.

Execution occurs without any user interaction such as clicking or hovering. The payload runs in the Contao backend origin under the session of whichever user opens the Comments module. From this position, the attacker acts as that user. They can read any module the user can access, create new administrator accounts, or edit templates. Template editing is a documented path to remote code execution on Contao systems.

Who is exposed

Any small business using Contao CMS versions from 4.0.0 up to 5.3.50 is exposed to this threat. Additionally, installations running version 5.4.0-RC1 through 5.7.12 are vulnerable. The GitHub advisory confirms that the composer package contao/comments-bundle is affected in these ranges. The vulnerability is fixed in versions 5.3.50 and 5.7.12. Administrators must verify their specific version number to determine if they are at risk.

Cost and compliance

The National Vulnerability Database assigns a CVSS score of 9.3 to CVE-2026-107845, classifying it as Critical. The weakness involves CWE-79, which is cross-site scripting, and CWE-116, which is improper encoding or escaping of output. These classifications indicate a severe risk to confidentiality, integrity, and availability. The lack of authentication requirements for the initial attack makes exploitation trivial for any internet-connected attacker.

What to watch

Monitor your Contao CMS version history against the released patch versions 5.3.50 and 5.7.12. Watch for any unusual administrative actions or new user accounts created in the backend, as these may indicate exploitation. Review server logs for suspicious POST requests to comment submission endpoints, especially from unauthenticated sources.

What to do and how to stay safe: Contao CMS

• Verify your current Contao CMS version and compare it against the affected ranges listed in the NVD record.
• Apply the security update to version 5.3.50 or 5.7.12 as soon as possible to patch the comments-bundle flaw.
• Audit backend user activity logs for unauthorized account creations or template modifications that could signal exploitation.
• Monitor web server access logs for unusual comment submissions or metadata payloads targeting the comments module.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Matters First

General security guidance from the SecOps Signal newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Contao CMS versions are vulnerable to CVE-2026-107845?

Versions 4.0.0 through 5.3.49 and 5.4.0-RC1 through 5.7.11 are vulnerable.

Is a fix available for this vulnerability?

Yes, the issue is fixed in Contao CMS versions 5.3.50 and 5.7.12.

Does comment moderation prevent this attack?

No, unpublished comments remain visible to moderators, guaranteeing exposure when they open the list.