Contao Remote Code Execution Vulnerability in Template Closures

A remote code execution vulnerability has been identified in Contao versions 4.0.0 prior to 4.13.57, 5.3.42 prior to 5.6.5, and 5.6.4. Back end users with specific control over template closure contents can execute arbitrary PHP functions that lack required parameters. This vulnerability has been patched in Contao versions 4.13.57, 5.3.42, and 5.6.5.

Impact

Exploitation of this vulnerability allows for arbitrary PHP code execution on the server.

Remediation

Users can upgrade to Contao versions 4.13.57, 5.3.42, or 5.6.5 to address this vulnerability. Alternatively, the issue can be temporarily mitigated by manually patching the 'Contao\Template::once()' method.