CVE-2026-47348 Details
Description
Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.
A cross-site scripting vulnerability has been identified in TYPO3 CMS versions 13.0.0 prior to 13.4.31 and 14.0.0 prior to 14.3.2. Editors with the ability to create or modify page content could include unfiltered HTML in page titles. These titles were then stored in the search index and, when displayed in the frontend search results through the Indexed Search plugin, were rendered without proper output encoding. This lack of sanitization allowed for the injection of malicious scripts.
Users are advised to update TYPO3 to versions 13.4.31 LTS or 14.3.3 LTS, which address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 9, 2026CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TYPO3/typo3/commit/2e96dd0e9fab7ad877b741fb9f6fc645b4270a3e | TYPO3 | Source CodeVendor |
| https://github.com/TYPO3/typo3/commit/8004b91a5951cfe01dda8554f77d0daa82d6b899 | TYPO3 | Source CodeVendor |
| https://typo3.org/security/advisory/typo3-core-sa-2026-010 | TYPO3 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 | >= 13.0.0, <= 13.4.30 (semver) >= 14.0.0, <= 14.3.2 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | TYPO3 |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | New CVE Received | TYPO3 |