-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 6.2.0, <= 6.2.38 | 6.2.39 |
| typo3/cms | composer | >= 7.0.0, <= 7.1.0 | 7.2.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from the third-party 'websvg' component (svg.swf) which handled SVG rendering via Flash. The PHP methods PageRenderer::loadSvg() and ScalableVectorGraphicsContentObject::render() were entry points that enabled loading this vulnerable component. The commit removed these integration points and the component itself, confirming their role in the attack surface. While the XSS execution occurred in the Flash component, these PHP functions facilitated its inclusion.