UpHeron
All vulnerabilities

Servers and applications

CVE-2020-26227

Cross-Site Scripting in Fluid view helpers

Severity
Medium 6.1
Published
17 Nov 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
6.2.54, 7.6.48, 8.7.38, 9.5.23, 10.4.10
Also known as
GHSA-vqqx-jw6p-q3rf
Sources
NVD, Project advisories (GitHub)

Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers. Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

Affected software

SoftwareAffected versions
TYPO3Servers and applications · cpe:a:typo3:typo3
  • From 6.2.0 before 6.2.54
  • From 7.6.0 before 7.6.48
  • From 8.7.0 before 8.7.38
  • From 9.0.0 before 9.5.23
  • From 10.0.0 before 10.4.10
TYPO3Servers and applications · github:typo3/typo3
  • From 10.0.0 before 10.4.10

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-26227
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-26227
  • GitHub Advisory Database https://github.com/advisories/GHSA-vqqx-jw6p-q3rf
  • github.com https://github.com/TYPO3/typo3/security/advisories/GHSA-vqqx-jw6p-q3rf