Executive brief
TypiCMS, a content management system, is vulnerable to a security flaw where malicious files can be uploaded to the server. An attacker with basic file upload permissions can upload a specially crafted image (SVG) containing hidden malicious code. If an administrator or another user views this file, the attacker could take over their account, steal sensitive information, or modify website content.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in TypiCMS Core's file upload module, specifically within `FileFormRequest.php` and `FileUploader.php`. The application whitelists SVG files but fails to sanitize their XML content for malicious elements like `<script>` tags or `on*` event handlers. An attacker with file upload privileges can upload a crafted SVG (optionally including a `viewBox` attribute to bypass parsing bugs) that, when accessed via its public URL, executes arbitrary JavaScript in the victim's browser. This allows for session impersonation, sensitive data exfiltration, and unauthorized administrative actions. The vulnerability is patched in versions 16.1.7, 15.0.29, 14.0.27, 13.0.9, and 12.0.5.
Affected products
- TypiCMS Core < 12.0.5, >= 13.0.0, < 13.0.9, >= 14.0.0, < 14.0.27, >= 15.0.0, < 15.0.29, >= 16.0.0, < 16.1.7
Timeline
- 2026-02-21: patched: Fix committed to repository
- 2026-02-25: advisory: GitHub Advisory published
- 2026-02-25: disclosed: NVD publication date