# CVE-2026-27621: TypiCMS Core stored XSS via SVG file upload

Source: https://junglewise.ai/threats/cve-2026-27621-typicms-core-stored-xss-via-svg-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-25. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-27621 · Severity: medium · CVSS 4 · Published 2026-02-25

TypiCMS, a content management system, is vulnerable to a security flaw where malicious files can be uploaded to the server. An attacker with basic file upload permissions can upload a specially crafted image (SVG) containing hidden malicious code. If an administrator or another user views this file, the attacker could take over their account, steal sensitive information, or modify website content.

Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-27621 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27621 being exploited in the wild.

**How severe is CVE-2026-27621?** Medium severity, with a CVSS score of 4, published 25 February 2026.

**Which products and versions are affected?** typicms/core (Packagist) ECOSYSTEM:introduced=16.0.0,fixed=16.1.7.

**Is there a fix for CVE-2026-27621?** Yes. typicms/core (Packagist): upgrade to 16.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-27621 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27621?** Check whether you run typicms/core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- typicms/core (Packagist): upgrade to 16.1.7 or later

  ```sh
  composer require typicms/core:^16.1.7
  ```


## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in TypiCMS Core's file upload module, specifically within `FileFormRequest.php` and `FileUploader.php`. The application whitelists SVG files but fails to sanitize their XML content for malicious elements like `<script>` tags or `on*` event handlers. An attacker with file upload privileges can upload a crafted SVG (optionally including a `viewBox` attribute to bypass parsing bugs) that, when accessed via its public URL, executes arbitrary JavaScript in the victim's browser. This allows for session impersonation, sensitive data exfiltration, and unauthorized administrative actions. The vulnerability is patched in versions 16.1.7, 15.0.29, 14.0.27, 13.0.9, and 12.0.5.

## Affected products

- TypiCMS Core < 12.0.5, >= 13.0.0, < 13.0.9, >= 14.0.0, < 14.0.27, >= 15.0.0, < 15.0.29, >= 16.0.0, < 16.1.7

## Identifiers

- CVE-2026-27621
- GHSA-xfvg-8v67-j7wp

## Timeline

- 2026-02-21: patched: Fix committed to repository
- 2026-02-25: advisory: GitHub Advisory published
- 2026-02-25: disclosed: NVD publication date

## References

- [https://api.github.com/users/lukasz-rybak](https://api.github.com/users/lukasz-rybak)
- [https://github.com/lukasz-rybak](https://github.com/lukasz-rybak)
- [https://api.github.com/users/lukasz-rybak/gists%7B/gist_id%7D](https://api.github.com/users/lukasz-rybak/gists%7B/gist_id%7D)
- [https://api.github.com/users/lukasz-rybak/repos](https://api.github.com/users/lukasz-rybak/repos)
- [https://avatars.githubusercontent.com/u/185241918?v=4](https://avatars.githubusercontent.com/u/185241918?v=4)
- [https://api.github.com/users/lukasz-rybak/events%7B/privacy%7D](https://api.github.com/users/lukasz-rybak/events%7B/privacy%7D)