6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27621

CVE-2026-27621: TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload

TypiCMS is a multilingual content management system based on the Laravel framework. A Stored Cross-Site Scripting (XSS) vulnerability exists in the file upload module of TypiCMS prior to version 16.1.7. The application allows users with file upload permissions to upload SVG files. While there is a MIME type validation, the content of the SVG file is not sanitized. An attacker can upload a specially crafted SVG file containing malicious JavaScript code. When another user (such as an administrator) views or accesses this file through the application, the script executes in their browser, leading to a compromise of that user's session. The issue is exacerbated by a bug in the SVG parsing logic, which can cause a 500 error if the uploaded SVG does not contain a viewBox attribute. However, this does not mitigate the XSS vulnerability, as an attacker can easily include a valid viewBox attribute in their malicious payload. Version 16.1.7 of TypiCMS Core fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27621

CVE-2026-27621:

6.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typicms/core	composer	< 16.1.7	16.1.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Stored Cross-Site Scripting (XSS) weakness in the file upload functionality of TypiCMS. The root cause is twofold. First, the rules() method within the FileFormRequest class explicitly allows files with the svg MIME type to be uploaded. This is the initial entry point for the attack. Second, the handle() method in the FileUploader service, which processes and saves the uploaded file, failed to sanitize the content of these SVG files before the patch. The provided commit d480a0be1e8e7c0600bb9a325bb11920ee66497d rectifies this by introducing a new sanitizeSvg method that is called from within the handle method if the uploaded file is an SVG. This confirms that FileUploader::handle was the function that vulnerably processed the unsanitized input. Therefore, both FileFormRequest::rules() and FileUploader::handle() would appear in a runtime profile during the exploitation of this vulnerability, as one permits the malicious file and the other processes and stores it.

Vulnerable functions

TypiCMS\Modules\Core\Services\FileUploader::handle

src/Services/FileUploader.php

This function is responsible for handling file uploads. The patch adds a call to a new `sanitizeSvg` method, indicating that prior to this change, SVG files were processed and saved without any content sanitization. This allowed an attacker to upload an SVG file containing malicious JavaScript, which would be stored on the server and executed in the browser of any user viewing the file.

TypiCMS\Modules\Core\Http\Requests\FileFormRequest::rules

src/Http/Requests/FileFormRequest.php

This function defines the validation rules for file uploads. It explicitly whitelists 'svg' as an allowed MIME type. This permissive validation is the entry point for the vulnerability, as it allows a malicious SVG file to be accepted by the application for further processing by the `FileUploader::handle` method.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.