{"id":"CVE-2025-29790","aliases":["GHSA-vqqr-fgmh-f626"],"url":"https://o3.security/vulnerability/CVE-2025-29790","summary":"Contao allows cross-site scripting through SVG uploads","details":"Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fixed in Contao 4.13.54, 5.3.30, or 5.5.6.","published":"2025-03-18T18:36:34.279Z","modified":"2026-08-08T03:48:12.681569250Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"contao/core-bundle","fixedVersion":"4.13.54"},{"ecosystem":"Packagist","name":"contao/core-bundle","fixedVersion":"5.3.30"},{"ecosystem":"Packagist","name":"contao/core-bundle","fixedVersion":"5.5.6"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29790.json"},{"type":"ADVISORY","url":"https://github.com/contao/contao/security/advisories/GHSA-vqqr-fgmh-f626"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29790"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:48:12.681569250Z"}}