CVE-2026-107845

Executive Summary

CVE-2026-107845 is a stored cross-site scripting (XSS) vulnerability in the Contao open-source content management system affecting versions from 4.0.0 through 5.3.49 and 5.7.11. An unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php, allowing attacker-controlled JavaScript to execute in the authenticated backend origin when an administrator opens the Comments module. With a CVSS score of 9.3, exploitation requires only a victim to view the comment listing, and successful execution grants full script control within the privileged CMS backend session.

Technical Analysis

The vulnerability resides in the comments-bundle component of Contao, specifically in the listComments() function defined in comments-bundle/contao/dca/tl_comments.php. This function is responsible for rendering comment metadata — the email address and website URL fields submitted alongside a comment — into the backend Comments module. According to the NVD description, these two fields are output without sufficient attribute encoding and URL encoding. This is a classic context-confusion failure: values submitted as part of an unauthenticated public comment form are later re-emitted into the HTML of an authenticated administrative interface.

The attack surface is the public comment submission form. Because Contao's comment feature is available to unauthenticated visitors by design, no credentials are needed to seed the malicious content. When an attacker supplies a crafted value into the email or website field, the string is persisted to the database as comment metadata. When a backend user subsequently opens the Comments module in the Contao administration area, listComments() renders that stored value. Because encoding is insufficient for the HTML attribute/URL context in which the value is placed, the attacker's markup — for example event-handler attributes or a javascript:-scheme URL if the site field is injected into an anchor's href — is interpreted rather than displayed literally.

The result is stored XSS executing in the origin of the Contao backend under the victim moderator's or administrator's session. Critically, the description confirms that unpublished comments remain visible to moderators, meaning the moderation queue itself is the delivery vector. An attacker can submit a comment without any need for it to be approved; simply leaving it in the pending queue is sufficient to place it in front of a reviewer. This defeats the common mitigation of "comments are sanitized on publication."

The applicable weakness classification is CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N reflects: network reachability, low attack complexity, no privileges required, user interaction required (the moderator must view the module), scope change (the compromise crosses from the anonymous public boundary into the privileged backend security context), high confidentiality and integrity impact, and no availability impact. Scope change (S:C) is the key factor inflating the score to 9.3 — the attacker operates from an unprivileged origin but achieves execution within a privileged one.

No public proof-of-concept, Nuclei template, or exploit code is available for this CVE at the time of writing. The technical narrative above is derived strictly from the vendor-supplied description; no specific payload strings or additional function names beyond those disclosed are asserted.

Exploitation Scenarios

Because no public exploit exists, the following chain is inferred from the stored-XSS vulnerability class and the facts disclosed in the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Contao deployment in the affected version range (4.0.0 through 5.3.49 or 5.7.11) that has the comments feature enabled. This is detectable via the presence of Contao's frontend comment form, CMS fingerprinting, or Shodan-style queries against Contao-identifying page elements (see METADATA dorks). No authentication is required for this step.

2. Triggering the flaw class. The attacker submits an ordinary public comment and places crafted content into the email or website metadata field. Because these fields are rendered without sufficient attribute and URL encoding by listComments(), the injected content is stored verbatim in the database. The attacker does not need the comment to be published — per the advisory, unpublished comments remain visible to moderators in the Comments module.

3. Payload / execution method. At the vulnerability-class level, this is a stored XSS: the attacker supplies markup designed to execute script when the value is placed into the rendered HTML attribute or URL context of the backend comment list. When a backend user opens the Comments module, listComments() emits the stored value into the page and the script executes in the Contao backend origin under that user's session. No specific payload syntax is asserted here because the description does not disclose it.

4. Post-exploitation impact. Script executing in the backend origin can act with the session of the victim moderator/administrator. Typical stored-XSS-in-CMS impact includes session token theft, performing authenticated administrative actions on the victim's behalf (content modification, user or configuration changes), and persistent re-injection into other administrative views. The CVSS high confidentiality and integrity subscores capture this potential for full read/write abuse of the backend, though no availability impact is scored.

Impact Assessment

CVE-2026-107845 carries a CVSS base score of 9.3 (Critical). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N indicates:

• Attack Vector (N): Exploitable over the network from any location.
• Attack Complexity (L): No special conditions or race windows required.
• Privileges Required (N): The initial injection is unauthenticated.
• User Interaction (R): A backend user must open the Comments module.
• Scope (C): Impact crosses a security boundary — anonymous public input reaches the privileged backend.
• Confidentiality (H) / Integrity (H): Script execution under a privileged session can read and alter sensitive backend data.
• Availability (N): No direct availability impact is scored.

The blast radius is significant for affected organizations: any Contao deployment exposing a public comment form is potentially vulnerable, and the impact lands on the highest-privilege interface — the CMS backend. A single moderator browsing the comment queue is sufficient to trigger execution. Because the injected content is stored, the attack is persistent and low-effort, posing an ongoing risk until patched. The lack of a public EPSS score (not yet scored by FIRST.org) and absence from CISA KEV mean current exploitation-in-the-wild is not established, but the low barrier to exploitation warrants prompt remediation.

Detection Guidance

Sigma Rule

title: Contao Comments Module Stored XSS - Suspicious Comment Metadata
id: 8f2a1c74-3b6e-4d9a-9c21-7a0e5f1b2d34
status: experimental
description: Detects HTTP requests submitting comment metadata containing script or event-handler patterns targeting the Contao comment form.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-107845
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'POST'
  selection_body:
    - 'email=' 
    - 'website='
  selection_xss:
    - '<script'
    - 'onerror='
    - 'onload='
    - 'javascript:'
    - 'onmouseover='
  condition: selection_method and selection_body and selection_xss
falsepositives:
  - Security scanners and fuzzing tools
  - Legitimate users pasting code into comment fields
level: high
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule CVE_2026_107845_Contao_Comment_XSS
{
    meta:
        description = "Detects stored XSS payloads targeting Contao comments email/website metadata (CVE-2026-107845)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-107845"
        cwe = "CWE-79"

    strings:
        $s1 = "<script" nocase
        $s2 = "onerror=" nocase
        $s3 = "onload=" nocase
        $s4 = "javascript:" nocase
        $s5 = "onmouseover=" nocase
        $field1 = "email" nocase
        $field2 = "website" nocase

    condition:
        (any of ($s*)) and (any of ($field*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-107845 Contao Comments Stored XSS Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"email="; nocase; http.request_body; content:"<script"; nocase; sid:2026107845; rev:1; reference:nvd,https://nvd.nist.gov/vuln/detail/CVE-2026-107845; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST" and
    http.request.body.content : ("email=" or "website=") and
    http.request.body.content : ("<script" or "onerror=" or "javascript:" or "onmouseover=")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=proxylogs
| eval request_body = lower(coalesce(form_data, request_body, ""))
| where match(request_body, "(email|website)=") AND match(request_body, "(<script|onerror=|onload=|javascript:|onmouseover=)")
| stats count min(_time) as first_seen max(_time) as last_seen values(request_body) as payloads by src_ip, uri_path

Wazuh OSSEC Rule

<group name="web,contao,xss,">
  <rule id="2026107" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>email=</match>
    <regex type="pcre2">&lt;script|onerror=|onload=|javascript:|onmouseover=</regex>
    <description>CVE-2026-107845: Possible Contao stored XSS payload in comment metadata POST request</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently confirmed). The advisory states the issue is fixed in Contao 5.3.50 and 5.7.12.

1. Immediate mitigations (if patching is delayed):

   • Disable the public comments feature where operationally feasible, or restrict comment submission to authenticated/trusted users, eliminating the unauthenticated injection path.
   • Apply output encoding at the web application firewall or reverse proxy layer for comment-form submissions containing script or event-handler patterns (see detection rules above).
   • Reduce the population of backend users who routinely open the Comments module, and enforce a strict Content Security Policy in the backend origin to reduce script execution impact.

2. Patch / upgrade steps:

   • Upgrade Contao to version 5.3.50 or 5.7.12 (or later). Note that the fix appears in 5.3.x and 5.7.x branches; legacy 4.x deployments should migrate to a supported, patched branch.
   • Validate the upgrade in a staging environment, then re-review any pending/unpublished comments that may already contain injected payloads prior to returning the Comments module to normal use.
   • Confirm the comments-bundle component is updated; verify encoding behavior of listComments() in the patched build.

3. Long-term hardening:

   • Adopt contextual output encoding for all user-supplied values (attribute and URL contexts specifically), not just generic HTML escaping.
   • Treat moderation-queue content as attacker-controlled and subject it to the same sanitization as published content.
   • Deploy backend CSP, monitor administrative session anomalies, and integrate the detection rules above into SOC workflows.
   • Track vendor advisories and subscribe to Contao security announcements for timely patching.

References

• NVD — CVE-2026-107845: https://nvd.nist.gov/vuln/detail/CVE-2026-107845
• Contao Security Advisories: https://contao.org/en/security-advisories
• GitHub Security Advisory (GHSA) — patch source claiming fix in 5.3.50 / 5.7.12 (single-source, unconfirmed)
• CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
• CISA Known Exploited Vulnerabilities Catalog: not listed (CISA KEV: NO) — no exploit-in-the-wild evidence or threat-actor campaign is currently associated with this CVE.