-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from two key issues: 1) UrlLinkHandler's scheme validation allowed crafted URLs to bypass security checks (evidenced by the patch adding explicit comments about 'java{TAB}script:' handling), and 2) typolink's failure to encode fallback text in HTML contexts (explicitly mentioned in the commit message). The combination of improper URL validation and lack of output encoding in core link rendering functions created the XSS vector.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 10.0.0, < 10.2.1 | 10.2.1 |
| typo3/cms-core | composer | >= 8.0.0, < 8.7.30 | 8.7.30 |
| typo3/cms-core | composer | >= 9.0.0, < 9.5.12 | 9.5.12 |