What’s Vulnerable › Vulnerabilities

CVE-2026-47348: TYPO3 CMS - Cross-Site Scripting in Indexed Search

• Severity: medium (CVSS 5.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-09 · updated 2026-07-23
• Weakness: CWE-79

Description

Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected products

• typo3: from 13.0.0 before 13.4.31; from 14.0.0 before 14.3.3 — fixed in 13.4.31, 14.3.3

How to fix

Upgrade to a fixed version: typo3 13.4.31, 14.3.3. Check the vendor advisory for mitigations.

References

• https://github.com/TYPO3/typo3/commit/2e96dd0e9fab7ad877b741fb9f6fc645b4270a3e
• https://github.com/TYPO3/typo3/commit/8004b91a5951cfe01dda8554f77d0daa82d6b899
• https://typo3.org/security/advisory/typo3-core-sa-2026-010

Get alerted when CVE-2026-47348 or the next vulnerability affects your stack