Is CVE-2026-107845 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107845 being exploited in the wild.

How severe is CVE-2026-107845?

Critical severity, with a CVSS score of 9.3, published 9 October 2026.

Which products and versions are affected?

Contao Comments Bundle 4.0.0 through 5.3.49; 5.4.0-RC1 through 5.7.11; contao/comments-bundle (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.3.50.

Is there a fix for CVE-2026-107845?

Yes. contao/comments-bundle (Packagist): upgrade to 5.3.50 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107845 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-107845?

Check whether you run Contao Comments Bundle or contao/comments-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107845: Contao Comments Bundle cross-site scripting in back end

CVE-2026-107845 · Severity: critical · CVSS 9.3 · Published 2026-10-09

Contao is a content management system used to build and manage websites. An unauthenticated attacker can inject malicious JavaScript into comments, which executes automatically when any back-end administrator opens the Comments module to review them. The attacker gains full control under that administrator's account and can create new admin accounts, modify templates, or execute arbitrary code.

Vendors: Contao, Packagist.

Quick answers

Is CVE-2026-107845 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107845 being exploited in the wild.
How severe is CVE-2026-107845?: Critical severity, with a CVSS score of 9.3, published 9 October 2026.
Which products and versions are affected?: Contao Comments Bundle 4.0.0 through 5.3.49; 5.4.0-RC1 through 5.7.11; contao/comments-bundle (Packagist) ECOSYSTEM:introduced=4.0.0,fixed=5.3.50.
Is there a fix for CVE-2026-107845?: Yes. contao/comments-bundle (Packagist): upgrade to 5.3.50 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107845 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-107845?: Check whether you run Contao Comments Bundle or contao/comments-bundle (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

contao/comments-bundle (Packagist): upgrade to 5.3.50 or later
```
composer require contao/comments-bundle:^5.3.50
```

Technical details

A stored cross-site scripting (CWE-79, CWE-116) vulnerability exists in the Contao comments bundle due to improper output encoding of user-supplied comment text in the back-end interface. An unauthenticated front-end visitor can submit a comment containing JavaScript that executes in the back-end administrator's browser session when comments are viewed, with no user interaction required beyond opening the Comments module. The back end lacks a Content-Security-Policy header to mitigate inline script execution, and published or unpublished comments are both rendered, making exposure certain during moderation.

Affected products

Contao Comments Bundle 4.0.0 through 5.3.49; 5.4.0-RC1 through 5.7.11

Identifiers

CVE-2026-107845
GHSA-628f-v4f6-p37r

Timeline

2026-08-25: disclosed
2026-10-09: advisory

References

https://api.github.com/users/HDWSec

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.