-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from three unencoded outputs in ShowImageController:
The commit 3764749 added htmlspecialchars() to all these locations, confirming they were unsafe raw outputs. The XSS vulnerability occurred because an attacker with backend access could store malicious payloads in file metadata properties, which would render unescaped in the frontend via the tx_cms_showpic endpoint.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 9.0.0, <= 9.5.47 | 9.5.48 |
| typo3/cms-core | composer | >= 10.0.0, <= 10.4.44 | 10.4.45 |
| typo3/cms-core | composer | >= 11.0.0, <= 11.5.36 | 11.5.37 |
| typo3/cms-core | composer | >= 12.0.0, <= 12.4.14 | 12.4.15 |
| typo3/cms-core | composer | >= 13.0.0, <= 13.1.0 | 13.1.1 |