6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-95qm-3xp7-vfj5

GHSA-95qm-3xp7-vfj5: TYPO3 Cross-Site Scripting in Form Framework validation handling

It has been discovered that the output of field validation errors in the Form Framework is vulnerable to cross-site scripting.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-95qm-3xp7-vfj5

GHSA-95qm-3xp7-vfj5:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-core	composer	>= 10.0.0, < 10.2.1	10.2.1
typo3/cms-core	composer	>= 8.0.0, < 8.7.30	8.7.30
typo3/cms-core	composer	>= 9.0.0, < 9.5.12	9.5.12

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from improper output encoding in form validation error handling. TYPO3's Form Framework uses ValidationResultsViewHelper to display errors and AbstractElementRenderer for element-level error rendering. Both components process user-controlled validation messages but failed to apply context-aware escaping before including them in HTML output. This matches the XSS pattern described in CWE-79 and aligns with TYPO3's architecture where ViewHelpers and Renderers handle frontend output generation. The high confidence comes from the direct correlation between these components' responsibilities and the vulnerability description's focus on validation error output.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.