PT-2026-21843 · Typicms+1 · Typicms+1

Lukasz-Rybak · Published 2026-02-25 · Updated 2026-02-25 · CVE-2026-27621

Positive Technologies (AI Summary)

CVSS v4.0

6.8

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TypiCMS versions prior to 16.1.7

Description TypiCMS is a content management system built on the Laravel framework. A stored cross-site scripting (XSS) issue exists in the file upload functionality. The application permits users with file upload privileges to upload SVG files, but it does not properly sanitize the file content despite MIME type validation. An attacker can upload a malicious SVG file containing JavaScript code. When another user views the file, the script executes in their browser, potentially compromising their session. The vulnerability is not mitigated by a 500 error that can occur if the SVG file lacks a viewBox attribute, as attackers can include a valid viewBox attribute in their payload.

Recommendations Update TypiCMS to version 16.1.7 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-27621

GHSA-XFVG-8V67-J7WP

Affected Products

Laravel

Typicms

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27621.json · Exploit
• https://github.com/TypiCMS/Core/security/advisories/GHSA-xfvg-8v67-j7wp · Vendor Advisory
• https://github.com/TypiCMS/Core/commit/d480a0be1e8e7c0600bb9a325bb11920ee66497d · Patch
• https://osv.dev/vulnerability/CVE-2026-27621 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xfvg-8v67-j7wp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27621 · Security Note
• https://github.com/TypiCMS/Core · Note
• https://twitter.com/CVEnew/status/2026641368873828561 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026576218057822676 · Twitter Post