{"id":"CVE-2025-29790","aliases":["GHSA-vqqr-fgmh-f626"],"url":"https://o3.security/vulnerability/CVE-2025-29790","summary":"Contao allows cross-site scripting through SVG uploads","details":"### Impact\n\nUsers can upload SVG files with malicious code, which is then executed in the back end and/or front end.\n\n### Patches\n\nUpdate to Contao 4.13.54, 5.3.30 or 5.5.6.\n\n### Workarounds\n\nRemove `svg,svgz` from the allowed upload file types in the system settings and from `contao.editable_files` in the `config.yaml`.\n\n### References\n\nhttps://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads\n\n### For more information\n\nIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).","published":"2025-03-18T18:36:34.279Z","modified":"2026-08-12T03:51:20.695417858Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"contao/core-bundle","fixedVersion":"4.13.54"},{"ecosystem":"Packagist","name":"contao/core-bundle","fixedVersion":"5.3.30"},{"ecosystem":"Packagist","name":"contao/core-bundle","fixedVersion":"5.5.6"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/29xxx/CVE-2025-29790.json"},{"type":"ADVISORY","url":"https://github.com/contao/contao/security/advisories/GHSA-vqqr-fgmh-f626"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-29790"},{"type":"PACKAGE","url":"https://github.com/contao/contao"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:20.695417858Z"}}