GHSA-w53m-gxvg-vx7p · Severity: medium · Ecosystem: composer — Contao can disclose sensitive information in the news module
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.
Conclusion & alert: CVE-2025-57757 is rated Low Risk (28.7/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.07%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-05-14 | 0.04% | 0.07% | +0.03% |
| 2 | 2026-01-24 | 0.05% | 0.04% | -0.01% |
| 3 | 2025-12-28 | — | 0.05% | — |
Full EPSS history (4 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.3 | 3.1 | MEDIUM |
|
3.9 | 1.4 | [email protected] |
GHSA-w53m-gxvg-vx7p · Severity: medium · Ecosystem: composer — Contao can disclose sensitive information in the news module
| URL | Tags |
|---|---|
| https://contao.org/en/security-advisories/information-disclosure-in-the-news-module | Vendor Advisory |
| https://github.com/contao/contao/commit/e75f46b11974fbf7a4652e65c19ad6ca84c59271 | Patch |
| https://github.com/contao/contao/security/advisories/GHSA-w53m-gxvg-vx7p | Patch Third Party Advisory |