Commit "23e8cca3136a" hardened the search-result title against insert-tag/XSS by setting "$objTemplate->title = StringUtil::specialchars(StringUtil::stripInsertTags($arrResult[$i]['title']))". But the default template does not use that "title" variable - it prints the raw "link" variable, which is assigned WITHOUT escaping. ## Impact Honesty caveat (important): on 5.7.9 the DEFAULT search template is the Twig "search_default.html.twig", which does not use the raw "link" variable and auto-escapes - so a default install is NOT affected. The vulnerable raw echo is in the legacy "search_default.html5" template (still shipped and selectable in 5.7.9, line 8: "<?= $this->link ?>"); exploitation requires that legacy template to be active for the search module (common on sites migrated from earlier Contao / using custom template selection). Where the legacy template is used, the sink is unambiguously raw and "ModuleSearch::compile()" assigns "link" from the entity-decoded indexed title. A backend page editor can store script that executes for anonymous front-end visitors (and admins) viewing search results, a stored XSS crossing the editor -> anonymous-visitor boundary. ## Credits This security vulnerability was found by @HDWSec