NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘 Packagist
Not in CISA KEV

CVE-2025-29790 — core-bundle

CVE-2025-29790 is a Cross-site Scripting (XSS) vulnerability in contao/core-bundle. A fix is available for contao/core-bundle — see the affected versions and patch details below.

Contao allows cross-site scripting through SVG uploads

Also known asGHSA-vqqr-fgmh-f626
Published
Updated
Affected
3 pkgs
Patched
3 / 3
Exploits
None indexed
Exploitation data as of Nov 7, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2025-29790.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs13th percentile — riskier than 13% of all scored CVEsHighest risk
0.00%0.40%0.80%1.20%0.7%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

3 pkgs affected
🐘contao/core-bundle🐘contao/core-bundle🐘contao/core-bundle

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Impact

Users can upload SVG files with malicious code, which is then executed in the back end and/or front end.

Patches

Update to Contao 4.13.54, 5.3.30 or 5.5.6.

Workarounds

Remove svg,svgz from the allowed upload file types in the system settings and from contao.editable_files in the config.yaml.

References

https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

Affected Packages

3 total 3 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagistcontao/core-bundle≥ 4.0.0&&< 4.13.544.13.54composer require contao/core-bundle:^4.13.54
🐘Packagistcontao/core-bundle≥ 5.3.0&&< 5.3.305.3.30composer require contao/core-bundle:^5.3.30
🐘Packagistcontao/core-bundle≥ 5.4.0&&< 5.5.65.5.6composer require contao/core-bundle:^5.5.6

Affected Products

1 product · 3 configurations
Application
contaocontao
≥ 5.4.0 && < 5.5.6
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for contao/core-bundle, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update contao/core-bundle to 4.13.54 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-29790 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. ### Patches Update to Contao 4.13.54, 5.3.30 or 5.5.6. ### Workarounds Remove `svg,svgz` from the allowed upload file types in the system settings and from `contao.editable_files` in the `config.yaml`. ### References https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads ### For more information If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).
O3 Security · Impact-Aware SCA

Is CVE-2025-29790 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2025-29790: core-bundle — Fixed in 4.13.54