# CVE-2026-47348: TYPO3 CMS XSS in Indexed Search component

Source: https://junglewise.ai/threats/cve-2026-47348-typo3-cms-xss-in-indexed-search-component  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-47348 · Severity: medium · CVSS 4 · Published 2026-06-09

TYPO3 CMS is a popular open-source content management system used for building and managing websites. A security flaw in its search functionality allows authorized editors to inject malicious scripts into page titles. If a visitor views these titles in search results, the script could execute in their browser, potentially leading to unauthorized actions or the theft of sensitive session information.

Technologies: [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Typo3](https://junglewise.ai/threats/vendors/typo3).

## Quick answers

**Is CVE-2026-47348 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47348 being exploited in the wild.

**How severe is CVE-2026-47348?** Medium severity, with a CVSS score of 4, published 9 June 2026.

**Which products and versions are affected?** typo3/cms-core (Packagist) ECOSYSTEM:introduced=13.0.0,fixed=13.4.31; typo3/cms-indexed-search (Packagist) ECOSYSTEM:introduced=13.0.0,fixed=13.4.31; Typo3 Indexed Search 13.0.0 to 13.4.30, 14.0.0 to 14.3.2.

**Is there a fix for CVE-2026-47348?** Yes. typo3/cms-core (Packagist): upgrade to 13.4.31 or later; typo3/cms-indexed-search (Packagist): upgrade to 13.4.31 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47348 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47348?** Check whether you run typo3/cms-core (Packagist), typo3/cms-indexed-search (Packagist) or Typo3 Indexed Search at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- typo3/cms-core (Packagist): upgrade to 13.4.31 or later

  ```sh
  composer require typo3/cms-core:^13.4.31
  ```

- typo3/cms-indexed-search (Packagist): upgrade to 13.4.31 or later

  ```sh
  composer require typo3/cms-indexed-search:^13.4.31
  ```


## Technical details

A stored Cross-Site Scripting (XSS) vulnerability exists in the TYPO3 Indexed Search (indexed_search) extension. The root cause is a failure to sanitize page titles before they are stored in the search index and a subsequent failure to apply proper output encoding when these titles are rendered in frontend search results. An attacker with 'editor' privileges (Privileges Required: Low) can include HTML markup in page titles. When a victim performs a search that returns the malicious page title, the payload executes in the victim's browser context. This issue is fixed in TYPO3 versions 13.4.31 and 14.3.3.

## Affected products

- TYPO3 TYPO3 CMS 13.0.0 to 13.4.30, 14.0.0 to 14.3.2
- TYPO3 Indexed Search (indexed_search) 13.0.0 to 13.4.30, 14.0.0 to 14.3.2

## Identifiers

- CVE-2026-47348
- GHSA-cg75-qfg2-w9hj

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: patched
- 2026-06-12: advisory

## References

- [https://github.com/TYPO3/typo3/security/advisories/GHSA-cg75-qfg2-w9hj](https://github.com/TYPO3/typo3/security/advisories/GHSA-cg75-qfg2-w9hj)
- [https://github.com/TYPO3/typo3/commit/2e96dd0e9fab7ad877b741fb9f6fc645b4270a3e](https://github.com/TYPO3/typo3/commit/2e96dd0e9fab7ad877b741fb9f6fc645b4270a3e)
- [https://github.com/TYPO3/typo3/commit/8004b91a5951cfe01dda8554f77d0daa82d6b899](https://github.com/TYPO3/typo3/commit/8004b91a5951cfe01dda8554f77d0daa82d6b899)
- [https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47348.yaml](https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47348.yaml)
- [https://typo3.org/security/advisory/typo3-core-sa-2026-010](https://typo3.org/security/advisory/typo3-core-sa-2026-010)

## Related threats

- [The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started](https://junglewise.ai/threats/cve-2026-19418-typo3-cms-broken-access-control-in-backend-and-install-tool)
- [TYPO3 CMS broken access control in Media Module](https://junglewise.ai/threats/cve-2026-49742-typo3-cms-broken-access-control-in-media-module)
- [TYPO3 CMS broken access control in Form Framework form_definition table](https://junglewise.ai/threats/cve-2026-49741-typo3-cms-broken-access-control-in-form-framework-form-definition)
- [TYPO3 CMS insecure deserialization in VariableFrontend and Registry](https://junglewise.ai/threats/cve-2026-49740-typo3-cms-insecure-deserialization-in-variablefrontend-and)
- [TYPO3 CMS path traversal in GeneralUtility::isAllowedAbsPath](https://junglewise.ai/threats/cve-2026-49738-typo3-cms-path-traversal-in-generalutility-isallowedabspath)