Skip to main content

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2025-57757

Medium
5.3/10

Summary

Contao is an Open Source CMS. In affected versions, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. A workaround involves not adding protected news archives to the news feed page. This issue affects contao/news-bundle and contao/contao versions 5.0.0-RC3 through 5.3.37 and 5.4.0-RC1 through 5.6.0.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • LOW
  • NONE

CWE-200 - Information Exposure

An information exposure vulnerability is categorized as an information flow (IF) weakness, which can potentially allow unauthorized access to otherwise classified information in the application, such as confidential personal information (demographics, financials, health records, etc.), business secrets, and the application's internal environment.

References

Advisory Timeline

  • Published