Is CVE-2026-27621 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27621 being exploited in the wild.

How severe is CVE-2026-27621?

Medium severity, with a CVSS score of 4, published 25 February 2026.

Which products and versions are affected?

typicms/core (Packagist) ECOSYSTEM:introduced=16.0.0,fixed=16.1.7.

Is there a fix for CVE-2026-27621?

Yes. typicms/core (Packagist): upgrade to 16.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-27621 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27621?

Check whether you run typicms/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27621: TypiCMS Core stored XSS via SVG file upload

CVE-2026-27621 · Severity: medium · CVSS 4 · Published 2026-02-25

TypiCMS, a content management system, is vulnerable to a security flaw where malicious files can be uploaded to the server. An attacker with basic file upload permissions can upload a specially crafted image (SVG) containing hidden malicious code. If an administrator or another user views this file, the attacker could take over their account, steal sensitive information, or modify website content.

Vendors: Packagist.

Quick answers

Is CVE-2026-27621 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27621 being exploited in the wild.
How severe is CVE-2026-27621?: Medium severity, with a CVSS score of 4, published 25 February 2026.
Which products and versions are affected?: typicms/core (Packagist) ECOSYSTEM:introduced=16.0.0,fixed=16.1.7.
Is there a fix for CVE-2026-27621?: Yes. typicms/core (Packagist): upgrade to 16.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-27621 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27621?: Check whether you run typicms/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

typicms/core (Packagist): upgrade to 16.1.7 or later
```
composer require typicms/core:^16.1.7
```

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in TypiCMS Core's file upload module, specifically within `FileFormRequest.php` and `FileUploader.php`. The application whitelists SVG files but fails to sanitize their XML content for malicious elements like `<script>` tags or `on*` event handlers. An attacker with file upload privileges can upload a crafted SVG (optionally including a `viewBox` attribute to bypass parsing bugs) that, when accessed via its public URL, executes arbitrary JavaScript in the victim's browser. This allows for session impersonation, sensitive data exfiltration, and unauthorized administrative actions. The vulnerability is patched in versions 16.1.7, 15.0.29, 14.0.27, 13.0.9, and 12.0.5.

Affected products

TypiCMS Core < 12.0.5, >= 13.0.0, < 13.0.9, >= 14.0.0, < 14.0.27, >= 15.0.0, < 15.0.29, >= 16.0.0, < 16.1.7

Identifiers

CVE-2026-27621
GHSA-xfvg-8v67-j7wp

Timeline

2026-02-21: patched: Fix committed to repository
2026-02-25: advisory: GitHub Advisory published
2026-02-25: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.