CVE-2020-26227

MEDIUM

TYPO3 6.2.0-6.2.53, 9.0.0-9.5.22, 10.0.0-10.4.9 - Cross-Site Scripting via Fluid View Helper Argument

Title source: llm
STIX 2.1

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_confirm
https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-vqqx-jw6p-q3rf
Exploit, Vendor Advisory x_refsource_misc
https://typo3.org/security/advisory/typo3-core-sa-2020-010

Scores

CVSS v3 6.1
EPSS 0.0036
EPSS Percentile 58.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-79
Status published
Products (3)
typo3/cms 10.0.0 - 10.4.10Packagist
typo3/cms-core 9.0.0 - 9.5.23Packagist
typo3/typo3 6.2.0 - 6.2.54
Published Nov 23, 2020
Tracked Since Feb 18, 2026