Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
TYPO3 Cross-Site Scripting in Templates
published 2 years ago
Summary
Attackers can inject malicious code into TYPO3 templates through unencoded user input. This can let them take control of user sessions or steal sensitive information. Update TYPO3 to the latest version to fix this vulnerability.
What to do
- Update typo3 cms-core to version 8.7.23.
- Update typo3 cms-core to version 9.5.4.
- Update typo3 cms-fluid to version 8.7.23.
- Update typo3 cms-fluid to version 9.5.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | typo3 | cms-core |
>= 8.0.0, < 8.7.23 >= 9.0.0, < 9.5.4 Fix: upgrade to 8.7.23
|
| composer | typo3 | cms-fluid |
>= 8.0.0, < 8.7.23 >= 9.0.0, < 9.5.4 Fix: upgrade to 8.7.23
|
Original advisory text
TYPO3 Cross-Site Scripting in Fluid ViewHelpers
Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting.
References
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2...
- https://typo3.org/security/advisory/typo3-core-sa-2019-005
- https://github.com/advisories/GHSA-22q7-cg4r-p9mx
- https://github.com/TYPO3-CMS/fluid/commit/1a65dcc4a8f17f61a8055c0fd46c324c44c998...
- https://github.com/TYPO3-CMS/fluid/commit/a40f468d1534a68cfce91ce2a8e2a1ff81db5c...
- https://github.com/TYPO3-CMS/fluid/compare/v8.7.22...v8.7.23
- https://github.com/TYPO3-CMS/fluid/compare/v9.5.3...v9.5.4
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published30 May 2024
Updated16 Jul 2026
First seen6 Mar 2026
Sources
GHSA-22q7-cg4r-p9mx · GHSA
Track software like this
Free during beta