PT-2026-47741 · Typo3 · Typo3/Cms

Jan Kahmen + 1 · CVE-2026-47348 · Published 2026-06-09 · Updated 2026-06-12

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 13.0.0 through 13.4.30 TYPO3 CMS versions 14.0.0 through 14.3.2

Description Editors with permissions to create or modify page content can include HTML markup in page titles. These titles are stored in the search index without sanitization and are subsequently rendered without proper output encoding when displayed in frontend search results via the Indexed Search plugin. This leads to Cross-Site Scripting, a condition where malicious scripts are injected into otherwise trusted websites.

Recommendations Update TYPO3 CMS versions 13.0.0 through 13.4.30 to a version later than 13.4.30. Update TYPO3 CMS versions 14.0.0 through 14.3.2 to a version later than 14.3.2.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-47348

GHSA-CG75-QFG2-W9HJ

Affected Products

Typo3/Cms

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47348.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47348.yaml · Exploit
• https://github.com/TYPO3/typo3/commit/8004b91a5951cfe01dda8554f77d0daa82d6b899 · Patch
• https://github.com/TYPO3/typo3/commit/2e96dd0e9fab7ad877b741fb9f6fc645b4270a3e · Patch
• https://typo3.org/security/advisory/typo3-core-sa-2026-010 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-47348 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cg75-qfg2-w9hj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-47348 · Security Note
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-cg75-qfg2-w9hj · Note
• https://packagist.org · Note
• https://twitter.com/CVEnew/status/2064342508994232489 · Twitter Post