Contao CMS CVE-2026-107845

Requires the comments-bundle feature to be in use with a public-facing comment form that accepts unauthenticated submissions (the entry point for the stored payload). Exploitation completes only when a backend user with access to the Comments module opens it to review submissions - the attacker cannot self-trigger execution (UI:R). Notably, moderation is NOT a mitigating control: unpublished/pending comments are still rendered to moderators, so an unapproved malicious comment still fires. Limiting factors: affected versions are 4.0.0 through pre-5.3.50 and pre-5.7.12; the site must expose comment functionality; and a privileged backend user must view the module for the payload to run in their session.

This is a genuine high-priority issue, not merely a high-CVSS paper risk. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N, 9.3 Critical) is internally consistent with the description: an unauthenticated remote attacker (PR:N) can plant a stored XSS payload via a public comment form with low complexity (AC:L), and the scope change (S:C) reflects script executing in the privileged Contao backend origin under a moderator/admin session, justifying C:H/I:H. The one real brake on severity is UI:R - exploitation only fires when a backend user opens the Comments module, so this is operator-triggered rather than fully autonomous. No EPSS probability, no CISA KEV entry, and no public exploit code were supplied, so there is no evidence of active or at-scale exploitation; however, the fix commit is public and shows the exact missing encoding (StringUtil::specialchars / specialcharsUrl), which materially lowers the bar for an attacker to reconstruct a working payload. Exploitation status: no public exploit identified at time of analysis. Net: treat as an urgent patch for any Contao install exposing a comment form, while recognizing realistic exploitation is targeted (requires a moderator to view comments) rather than wormable. Note explicitly: EPSS and KEV data are absent from the input and were not independently verified.

An unauthenticated visitor submits a comment on a public Contao page, placing a malicious payload (e.g., a javascript: URL or markup-breaking string) in the email or website field, which is stored without adequate attribute/URL encoding. When a backend moderator later opens the Comments module to review submissions - including unpublished ones, since moderation does not hide them - the payload executes in the backend origin under the moderator's authenticated session. No public exploit code is identified, but the public fix commit reveals the exact unencoded sink, easing payload construction.