CVE-2020-26229
XML External Entity in Dashboard Widget
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
XML External Entity in Dashboard Widget
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.
- Record
CVE-2020-26229- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-611
- Updated
- 2026-11-02
EUVDEUVD-2020-1468
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.
- Record
EUVD-2020-1468- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q9cp-mc96-m4w2
XML External Entity in Dashboard Widget
Problem
It has been discovered that RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions.
At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed.
Solution
Update to TYPO3 version 10.4.10 that fixes the problem described.
- Record
GHSA-q9cp-mc96-m4w2- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-611
- Updated
- 2026-11-02
NVD
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.
- Record
CVE-2020-26229- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L - CVSS 2.0
- 3.6 Low
AV:N/AC:H/Au:S/C:P/I:N/A:P - Weakness
- CWE-611
- Updated
- 2026-11-02
OSV
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.
- Record
CVE-2020-26229- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L - Updated
- 2026-11-02
OSVGHSA-q9cp-mc96-m4w2
XML External Entity in Dashboard Widget
Problem
It has been discovered that RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions.
At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed.
Solution
Update to TYPO3 version 10.4.10 that fixes the problem described.
- Record
GHSA-q9cp-mc96-m4w2- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L - Weakness
- CWE-611
- Updated
- 2026-11-02
OSVBIT-typo3-2020-26229 No score
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability with current PHP versions of supported and maintained system distributions. At least with libxml2 version 2.9, the processing of XML external entities is disabled per default - and cannot be exploited. Besides that, a valid backend user account is needed. Update to TYPO3 version 10.4.10 to fix the problem described.
- Record
BIT-typo3-2020-26229- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
10.0.0 up to 10.4.10 | 10.4.10 |
typo3/cmsPackagist |
10.0.0 up to 10.4.10 | 10.4.10 |
typo3Bitnami |
10.0.0 up to 10.4.10 | 10.4.10 |
typo3/cms-corePackagist |
10.0.0 up to 10.4.10, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 11 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.2v10.4.3v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 |
10.4.10 |
typo3/cmsPackagist |
10.0.0 up to 10.4.10, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 11 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.2v10.4.3v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 |
10.4.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-26229 is a low vulnerability (CVSS 3.7) in Typo3, published November 23, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 51st percentile. Fixed in typo3/cms-core 10.4.10.
References
github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-q9cp-mc96-m4w2
typo3.org/security/advisory/typo3-core-sa-2020-012
nvd.nist.gov/vuln/detail/CVE-2020-26229