5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47348

CVE-2026-47348: TYPO3 CMS - Cross-Site Scripting in Indexed Search

Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47348

CVE-2026-47348:

5.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-core	composer	>= 13.0.0, < 13.4.31	13.4.31
typo3/cms-core	composer	>= 14.0.0, < 14.3.3	14.3.3
typo3/cms-indexed-search	composer	>= 13.0.0, < 13.4.31	13.4.31
typo3/cms-indexed-search	composer	>= 14.0.0, < 14.3.3	14.3.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists within the compileSingleResultRow function of the TYPO3\CMS\IndexedSearch\Controller\SearchController class. This function is responsible for rendering individual search results. The core of the issue is that page titles, which can be controlled by an editor, were being included in the search result output without proper HTML encoding. The provided patches clearly show the addition of the htmlspecialchars() function call to the $title variable. This change ensures that any HTML characters within the title are properly escaped, preventing the browser from interpreting them as executable code. The vulnerability is triggered when a user views the search results page containing a maliciously crafted page title. Therefore, the compileSingleResultRow function is the exact location of the vulnerability and would be present in any runtime profile during exploitation.

Vulnerable functions

TYPO3\CMS\IndexedSearch\Controller\SearchController::compileSingleResultRow

typo3/sysext/indexed_search/Classes/Controller/SearchController.php

The `compileSingleResultRow` function is responsible for preparing and rendering a single search result row. The vulnerability lies in the fact that the page title, retrieved from `$resultData['item_title']`, was not being properly sanitized before being rendered in the search results. An attacker could craft a page title with malicious HTML and script content. When this page is indexed and a user searches for it, this function would include the unsanitized title in the output, leading to a cross-site scripting (XSS) attack in the context of the user's browser. The patch mitigates this by applying `htmlspecialchars()` to the `$title` variable before it is used in the output, thus neutralizing any embedded scripts.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.