Vulnerability advisory

GHSA-vqqx-jw6p-q3rf

Cross-Site Scripting in Fluid view helpers

Published Dec 21, 2020Updated Sep 10, 2026OSV record ↗

Also known as BIT-typo3-2020-26227CVE-2020-26227

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected versions

typo3/cms-core Packagist

All typo3/cms-core advisories →

Affected	Fixed in
`9.0.0` to before 9.5.23	`9.5.23`Advisories →
Also listed as affected (32) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.10` `v9.5.11` `v9.5.12` `v9.5.13` `v9.5.14` `v9.5.15` `v9.5.16` `v9.5.17` `v9.5.18` `v9.5.19` `v9.5.2` `v9.5.20` `v9.5.21` `v9.5.22` `v9.5.3` `v9.5.4` `v9.5.5` `v9.5.6` `v9.5.7` `v9.5.8` `v9.5.9`
`10.0.0` to before 10.4.10	`10.4.10`Advisories →
Also listed as affected (16) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.2` `v10.4.3` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`8.7.0` to before 8.7.38	`8.7.38`Advisories →
Also listed as affected (26) `v8.7.10` `v8.7.11` `v8.7.12` `v8.7.13` `v8.7.14` `v8.7.15` `v8.7.16` `v8.7.17` `v8.7.18` `v8.7.19` `v8.7.20` `v8.7.21` `v8.7.22` `v8.7.23` `v8.7.24` `v8.7.25` `v8.7.26` `v8.7.27` `v8.7.28` `v8.7.29` `v8.7.30` `v8.7.31` `v8.7.32` `v8.7.7` `v8.7.8` `v8.7.9`

typo3/cms Packagist

All typo3/cms advisories →

Affected	Fixed in
`10.0.0` to before 10.4.10	`10.4.10`Advisories →
Also listed as affected (16) `v10.0.0` `v10.1.0` `v10.2.0` `v10.2.1` `v10.2.2` `v10.3.0` `v10.4.0` `v10.4.1` `v10.4.2` `v10.4.3` `v10.4.4` `v10.4.5` `v10.4.6` `v10.4.7` `v10.4.8` `v10.4.9`
`9.0.0` to before 9.5.23	`9.5.23`Advisories →
Also listed as affected (32) `v9.0.0` `v9.1.0` `v9.2.0` `v9.2.1` `v9.3.0` `v9.3.1` `v9.3.2` `v9.3.3` `v9.4.0` `v9.5.0` `v9.5.1` `v9.5.10` `v9.5.11` `v9.5.12` `v9.5.13` `v9.5.14` `v9.5.15` `v9.5.16` `v9.5.17` `v9.5.18` `v9.5.19` `v9.5.2` `v9.5.20` `v9.5.21` `v9.5.22` `v9.5.3` `v9.5.4` `v9.5.5` `v9.5.6` `v9.5.7` `v9.5.8` `v9.5.9`
`8.7.0` to before 8.7.38	`8.7.38`Advisories →
Also listed as affected (33) `8.7.0` `8.7.1` `8.7.2` `v8.7.10` `v8.7.11` `v8.7.12` `v8.7.13` `v8.7.14` `v8.7.15` `v8.7.16` `v8.7.17` `v8.7.18` `v8.7.19` `v8.7.20` `v8.7.21` `v8.7.22` `v8.7.23` `v8.7.24` `v8.7.25` `v8.7.26` `v8.7.27` `v8.7.28` `v8.7.29` `v8.7.3` `v8.7.30` `v8.7.31` `v8.7.32` `v8.7.4` `v8.7.5` `v8.7.6` `v8.7.7` `v8.7.8` `v8.7.9`

Description

Meta

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7)

CWE-79

Problem

It has been discovered that system extension Fluid (typo3/cms-fluid) of the TYPO3 core is vulnerable to cross-site scripting passing user-controlled data as argument to Fluid view helpers.

<f:form ... fieldNamePrefix="{payload}" />
<f:be.labels.csh ... label="{payload}" />
<f:be.menus.actionMenu ... label="{payload}" />

Solution

Update to TYPO3 versions 9.5.23 or 10.4.10 that fix the problem described.

Credits

Thanks to TYPO3 security team member Oliver Hader who reported this issue and to TYPO3 security team members Helmut Hummel & Oliver Hader who fixed the issue.

References

TYPO3-CORE-SA-2020-010