CVE-2025-29790 — Contao allows cross-site scripting through SVG uploads
Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13…
Published: 2025-03-18 · CVSS: 4.8 · CVSS 4.0
Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7