CVE-2026-107845: Contao: Cross-site scripting in the comments bundle

In the back end, the listComments method in comments-bundle/contao/dca/tl_comments.php builds links from the commenter's email address and website. The email went into a mailto: link and the website into an href without escaping. An attacker posts a public comment with a crafted value in one of those fields and injects an inline handler (CWE-79, CWE-116).

The visitor needs no account. The script runs when any back end user opens the Comments module, with no click or hover needed, and it runs under that user's session. Contao sends no Content-Security-Policy header on the back end, so nothing blocks the inline handler.

From there the payload acts as the victim through the back end. It can read any module they can reach, create a new administrator, or edit a template. The advisory notes that on Contao, template edit access is a documented path to code execution. Moderation does not help: unpublished comments are still inserted, and a moderator must open the list to review them.

Affected: contao/comments-bundle from 4.0.0 up to but not including 5.3.50, and from 5.4.0-RC1 up to but not including 5.7.12. Sites that have the comments bundle installed and let visitors post comments are exposed.

Check the installed version:

composer show contao/comments-bundle

If the bundle is not installed, the site is not affected.

Upgrade to contao/comments-bundle 5.3.50 on the 5.3 line, or 5.7.12 on the 5.7 line, or later. Update with Composer, for example:

composer update contao/comments-bundle

The fix is a one-line change: the email address now goes through StringUtil::specialchars() and the website href through StringUtil::specialcharsUrl(). The sources give no workaround. After updating, check existing comments for injected values, and consider reviewing back end users and templates.

Review the tl_comments table for comments whose email or website fields contain quotes, angle brackets or event-handler text such as onfocus or onmouseover. Check the back end for administrator accounts you did not create, and for templates changed recently. Look in the web server logs for outbound requests from admin browsers to unfamiliar hosts after a visit to the Comments module. Unpublished comments count, since they are stored too.

An unauthenticated front end visitor can post a comment containing a XSS injection. The victim is any back end user who opens the Comments module, and moderation makes exposure certain rather than preventing it. No Content-Security-Policy header is sent on the Contao back end, so nothing mitigates the inline handler.

Impact

Anyone on the internet can inject script that executes in the Contao back end origin, under the session of whichever user opens the Comments module, with no click and no hover. From there the payload acts as that user through the back end: reading any module they can reach, creating a new administrator, or editing a template, which on Contao is a documented path from back end write access to code execution. Moderation does not help and in fact guarantees exposure, since unpublished comments are still inserted and a moderator has to open the list to act on them.