CVE-2020-11070: Cross-Site Scripting in SVG Sanitizer

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-13 · updated 2026-06-17
Weakness: CWE-79

Description

The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not correctly processed and thus not sanitized at all. Albeit the markup is not valid it still is evaluated in browsers and leads to cross-site scripting. This is fixed in version 1.0.3.

Affected products

TYPO3GmbH svg_sanitizer: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: TYPO3GmbH svg_sanitizer 1.0.3. Check the vendor advisory for mitigations.

References

https://github.com/TYPO3GmbH/svg_sanitizer/security/advisories/GHSA-59cf-m7v5-wh5w
https://github.com/TYPO3GmbH/svg_sanitizer/security/advisories/GHSA-59cf-m7v5-wh5w

Get alerted when CVE-2020-11070 or the next vulnerability affects your stack