CVE-2026-107845 — XSS in contao/comments-bundle exposes backend when moderators view comments

What happened

An unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, that attacker-controlled script can execute in the Contao backend origin under the backend user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. (Sources: 3969, 8436, 4164, 32347.)

Technical cause

listComments() in comments-bundle/contao/dca/tl_comments.php renders comment email or website metadata without adequate attribute and URL encoding, resulting in a stored cross-site scripting (CWE-79) vulnerability. (Sources: 3969, 8436, 4164.)

Why it matters

The flaw permits attacker-controlled script to run within the Contao backend origin when a backend user views the Comments module. The published CVSS v3.1 score is 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), indicating a high-severity remote vulnerability with high confidentiality and integrity impact when triggered. (Sources: 32347, 3969, 8436.)

Who is affected

The vulnerability affects contao/comments-bundle. Affected ranges reported are 4.0.0 up to but not including 5.3.50, and 5.4.0-RC1 up to but not including 5.7.12 (expressed in sources as >=4.0.0,<5.3.50 and >=5.4.0-RC1,<5.7.12). (Sources: 3969, 4164, 8436.)

Discovery and timeline

The vulnerability was published on 2026-10-09 (advisories and database entries published 2026-10-09). No discoverer attribution is provided in the available sources. (Sources: 3969, 4164, 8436, 32347.)

Affected and fixed versions

Sources report fixed releases for contao/comments-bundle: 5.3.50 and 5.7.12. Affected ranges are given as >=4.0.0,<5.3.50 and >=5.4.0-RC1,<5.7.12. (Sources: 3969, 4164, 8436.)

Fixes and mitigation

Vendor fixes are available: the issue is fixed in contao/comments-bundle releases 5.3.50 and 5.7.12. The advisory notes that moderation alone does not prevent exposure because unpublished comments are visible to moderators. No additional vendor mitigations are listed in the sources. (Sources: 3969, 8436, 4164.)

Recommended action

Apply the vendor updates to contao/comments-bundle to a fixed release (5.3.50 or 5.7.12 as published). If you cannot immediately update, consider restricting access to the backend Comments module until you can apply the update and review comments for malicious content. Verify that comment metadata is properly encoded in any custom integrations. (Sources: 3969, 8436, 4164.)