CVE-2025-29790

Name of the Vulnerable Software and Affected Versions Contao versions prior to 4.13.54 Contao versions prior to 5.3.30 Contao versions prior to 5.5.6

Description The issue allows users to upload SVG files containing malicious code, which is then executed in the back end and/or front end.

Recommendations Update to Contao 4.13.54 or later. Update to Contao 5.3.30 or later. Update to Contao 5.5.6 or later. As a temporary workaround, consider removing svg,svgz from the allowed upload file types in the system settings and from contao.editable files in the config.yaml.