Sign in
Deutsch English Español Polski
Medium

Cross-Site Scripting via Rich-Text Content

  • Disclosed: 19.08.2021
  • Updated: 11.10.2026 10:22

Meta

  • CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC (5.7)

Problem

Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser do not consider all potentially malicious HTML tag & attribute combinations per default.

In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction.

In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.

Solution

Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above.

Custom package typo3/html-sanitizer - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios.

During the frontend rendering process, sanitization is applied to the default TypoScript path lib.parseFunc, which is implicitly used by the Fluid view-helper instruction f:format.html. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding ChangeLog documentation.

Credits

Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue.

References

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package typo3/cms >= 10.0.0, < 10.4.19, >= 11.0.0, < 11.3.2, >= 9.0.0, < 9.5.29, >= 8.0.0, < 8.7.42, >= 7.0.0, < 7.6.53 10.4.19, 11.3.2, 9.5.29, 8.7.42, 7.6.53
Composer package typo3/cms-core >= 7.0.0, < 7.6.53, >= 8.0.0, < 8.7.42, >= 10.0.0, < 10.4.19, >= 11.0.0, < 11.3.2, >= 9.0.0, < 9.5.29 7.6.53, 8.7.42, 10.4.19, 11.3.2, 9.5.29

References

CVSS score 6.1/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
typo3/cms, typo3/cms-core
Disclosed
19.08.2021
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-c5c9-8c6m-727v - CC BY 4.0

Vulnerability history: typo3/cms-core

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (128) in the archive
Total entries
128
First → latest
09.2018 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 35
  • Medium 84
  • Low 8

Disclosures per year

Severity:
  1. TYPO3 CMS - Broken Access Control in Backend and Install Tool
    High CVE-2026-19418 >= 14.0.0, < 14.3.6 14.3.6
  2. TYPO3 CMS has Broken Access Control in its Form Framework
    High CVE-2026-11607 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  3. TYPO3 CMS: Destructive Actions on File Mount Folders
    High CVE-2026-47343 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  4. TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
    High CVE-2026-49741 >= 14.0.0, < 14.3.3 14.3.3
  5. TYPO3 CMS has Broken Access Control in its Form Framework
    High CVE-2026-47346 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  6. TYPO3 CMS has Broken Access Control in its Media Module
    High CVE-2026-49742 >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 11.5.51, 12.4.46, 13.4.31, 14.3.3
  7. TYPO3 Allows Privilege Escalation to System Maintainer
    High · 7.2 CVE-2025-47940 >= 10.4.0, < 10.4.50, >= 11.0.0, < 11.5.44, >= 12.0.0, < 12.4.31, >= 13.0.0, < 13.4.12 10.4.50, 11.5.44, 12.4.31, 13.4.12
  8. TYPO3 Possible Insecure Deserialization in Extbase Request Handling
    High · 8.1 ghsa-5h5v-m596-r6rf >= 8.0.0, < 8.7.30, >= 9.0.0, < 9.5.12 8.7.30, 9.5.12
  9. TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API
    High · 8.8 ghsa-x428-565f-8xj2 >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8
  10. TYPO3 Security Misconfiguration in Frontend Session Handling
    High · 8.2 ghsa-82vp-jr39-4j2j >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8
  11. TYPO3 Arbitrary Code Execution via File List Module
    High · 8.8 ghsa-f9hr-7cfq-mjg2 >= 8.0.0, < 8.7.23, >= 9.0.0, < 9.5.4 8.7.23, 9.5.4
  12. TYPO3 Security Misconfiguration for Backend User Accounts
    High · 7.5 ghsa-rxc9-f2x6-qh4w >= 8.0.0, < 8.7.23, >= 9.0.0, < 9.5.4 8.7.23, 9.5.4
  13. TYPO3 Denial of Service in Frontend Record Registration
    High · 7.5 ghsa-hjx5-v9xg-7h25 >= 8.0.0, < 8.7.21, >= 7.0.0, < 7.6.32 8.7.21, 7.6.32
  14. TYPO3 Security Misconfiguration in Install Tool Cookie
    High · 7.5 ghsa-ppvg-hw62-6ph9 >= 8.0.0, < 8.7.21, >= 9.0.0, < 9.5.2, >= 7.0.0, < 7.6.32 8.7.21, 9.5.2, 7.6.32
  15. TYPO3 CMS Insecure Deserialization
    High · 7.5 ghsa-96jg-pmc4-cx39 >= 8.5.0, < 8.7.17, >= 9.0.0, < 9.3.1 8.7.17, 9.3.1
  16. TYPO3 CMS Privilege Escalation and SQL Injection
    High · 7.5 ghsa-45wj-jv2h-jwrf >= 8.5.0, < 8.7.17, >= 9.0.0, < 9.3.2 8.7.17, 9.3.2
  17. TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution
    Critical · 9.8 ghsa-cc97-g92w-jm65 >= 8.0.0, < 8.7.17, >= 9.0.0, < 9.3.2, >= 7.0.0, < 7.6.30 8.7.17, 9.3.2, 7.6.30
  18. TYPO3 CMS Authentication Bypass vulnerability
    High · 7.5 ghsa-x4rj-f7m6-42c3 >= 8.0.0, < 8.7.17, >= 9.0.0, < 9.3.2, >= 7.0.0, < 7.6.30 8.7.17, 9.3.2, 7.6.30
  19. TYPO3 Install Tool vulnerable to Code Execution
    High · 7.2 CVE-2024-22188 >= 8.0.0, < 8.7.57, >= 9.0.0, < 9.5.46, >= 10.0.0, < 10.4.43, >= 11.0.0, < 11.5.35, >= 12.0.0, < 12.4.11, >= 13.0.0, < 13.0.1 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  20. TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
    High · 7.1 CVE-2024-25121 >= 8.0.0, < 8.7.57, >= 9.0.0, < 9.5.46, >= 10.0.0, < 10.4.43, >= 11.0.0, < 11.5.35, >= 12.0.0, < 12.4.11, >= 13.0.0, < 13.0.1 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  21. TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
    High · 8.8 CVE-2023-24814 >= 12.0.0, < 12.2.0, >= 11.0.0, < 11.5.23, >= 10.0.0, < 10.4.36, >= 9.0.0, < 9.5.40, >= 8.7.0, < 8.7.51 12.2.0, 11.5.23, 10.4.36, 9.5.40, 8.7.51
  22. TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
    High · 7.5 CVE-2022-23503 >= 8.0.0, < 8.7.49, >= 9.0.0, < 9.5.38, >= 10.0.0, < 10.4.33, >= 11.0.0, < 11.5.20, >= 12.0.0, < 12.1.1 8.7.49, 9.5.38, 10.4.33, 11.5.20, 12.1.1
  23. TYPO3 Vulnerable to Insecure Deserialization
    High · 8.8 CVE-2019-12747 >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8
  24. TYPO3 Image Processing susceptible to Code Execution
    High · 7.5 CVE-2019-11832 >= 8.0.0, < 8.7.25, >= 9.0.0, < 9.5.6 8.7.25, 9.5.6
  25. TYPO3 Insecure Deserialization in Query Generator & Query View
    High · 8.8 CVE-2019-19849 >= 10.0.0, < 10.2.1, >= 8.0.0, < 8.7.30, >= 9.0.0, < 9.5.12 10.2.1, 8.7.30, 9.5.12
  26. TYPO3 SQL injection vulnerability in the Extbase Framework
    High · 7.4 CVE-2013-1842 >= 4.5.0, < 4.5.24, >= 4.6.0, < 4.6.17, >= 4.7.0, < 4.7.9, >= 6.0.0, < 6.0.3 4.5.24, 4.6.17, 4.7.9, 6.0.3
  27. Cross-Site-Request-Forgery in Backend
    High · 8.8 CVE-2021-41113 >= 11.2.0, < 11.5.0 11.5.0
  28. Cross-Site Scripting via Rich-Text Content this entry
    Medium · 6.1 CVE-2021-32768 >= 7.0.0, < 7.6.53, >= 8.0.0, < 8.7.42, >= 10.0.0, < 10.4.19, >= 11.0.0, < 11.3.2, >= 9.0.0, < 9.5.29 7.6.53, 8.7.42, 10.4.19, 11.3.2, 9.5.29
  29. Broken Access Control in Form Framework
    High · 8.3 CVE-2021-21357 >= 10.0.0, < 10.4.14, >= 11.0.0, < 11.1.1, >= 9.0.0, < 9.5.25 10.4.14, 11.1.1, 9.5.25
  30. Unrestricted File Upload in Form Framework
    High · 8.6 CVE-2021-21355 >= 10.0.0, < 10.4.14, >= 11.0.0, < 11.1.1, >= 9.0.0, < 9.5.25 10.4.14, 11.1.1, 9.5.25
  31. Cleartext storage of session identifier
    High · 8.1 CVE-2020-26228 >= 9.0.0, < 9.5.23, >= 10.0.0, < 10.4.10, >= 8.7.0, < 8.7.38 9.5.23, 10.4.10, 8.7.38
  32. Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
    High · 8.1 CVE-2020-15099 >= 9.0.0, < 9.5.20, >= 10.0.0, < 10.4.6 9.5.20, 10.4.6
  33. Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
    High · 8.8 CVE-2020-15098 >= 9.0.0, < 9.5.20, >= 10.0.0, < 10.4.6 9.5.20, 10.4.6
  34. Backend Same-Site Request Forgery in TYPO3 CMS
    High · 8.0 CVE-2020-11069 >= 9.0.0, < 9.5.17, >= 10.0.0, < 10.4.2 9.5.17, 10.4.2
  35. Insecure Deserialization in Backend User Settings in TYPO3 CMS
    High · 8.8 CVE-2020-11067 >= 9.0.0, < 9.5.17, >= 10.0.0, < 10.4.2 9.5.17, 10.4.2
  36. Class destructors causing side-effects when being unserialized in TYPO3 CMS
    High · 8.7 CVE-2020-11066 >= 9.0.0, < 9.5.17, >= 10.0.0, < 10.4.2 9.5.17, 10.4.2
  37. Deserialization of untrusted data in Symfony
    High · 7.1 CVE-2019-10912 >= 9.0.0, < 9.5.8 9.5.8

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.