Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Contao: Cross-site scripting in the comments bundle

Fix availableCritical · CVSS 9.3EPSS 0.27%

Published Oct 9, 2026 · updated Oct 9, 2026

What to do

  1. Upgrade to a fixed version: contao/comments-bundle 5.3.50, contao/comments-bundle 5.7.12.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

Composercontao/comments-bundle

Vulnerable versions
>= 4.0.0, < 5.3.50
Fixed in
5.3.50

Check your project: composer show contao/comments-bundle

Composercontao/comments-bundle

Vulnerable versions
>= 5.4.0-RC1, < 5.7.12
Fixed in
5.7.12

Check your project: composer show contao/comments-bundle

Sources

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') · CWE-116 Improper Encoding or Escaping of Output

← All critical vulnerabilities