Vulnerability advisory

GHSA-259v-xm34-p7fr

Typo3 Cross-Site Scripting in Language Pack Handling

Published Jun 5, 2024Updated Dec 2, 2024OSV record ↗

Severity

Severity not reported.

Affected versions

Affected	Fixed in
`9.0.0` to before 9.5.4	`9.5.4`Advisories →
Also listed as affected (13) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.2` `v9.5.3`

Failing to properly encode information from external sources, language pack handling in the install tool is vulnerable to cross-site scripting.