CVE-2025-65960
Contao 4.0.0 – 4.13.57
Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-65960 is a medium-severity Insufficient Type Distinction (CWE-351) vulnerability in Contao Contao. Its CVSS base score is 6.6 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-2 (Flaw Remediation) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199633
Vulnerability Data
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters.…
more
This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Backend-authenticated users can execute arbitrary PHP functions via template manipulation, directly enabling server-side scripting/command interpreter abuse.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the reported flaw by requiring timely application of the vendor patches (or the documented manual patch to Template::once) that eliminate the unsafe PHP function invocation path.
Limits the ability of backend users to obtain or exercise the precise template-closure editing rights that enable the arbitrary-function execution described in the CVE.
Requires validation of all user-supplied template content before it is processed, blocking the malformed closures that trigger unintended PHP function calls.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent type-distinction flaws during development while the control addresses the full lifecycle.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect type confusion vulnerabilities before deployment.
Secure development lifecycle practices can include type-safe design and validation to reduce type confusion.
Application security requirements can mandate explicit type handling and validation rules.
Secure architecture principles encourage strong typing and clear type boundaries in system design.
Secure coding standards directly address proper type distinction and validation to prevent type-related flaws.