CVE-2021-32768
Cross-Site Scripting via Rich-Text Content
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Cross-Site Scripting via Rich-Text Content
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
- Record
CVE-2021-32768- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2021-1673
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
- Record
EUVD-2021-1673- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c5c9-8c6m-727v
Cross-Site Scripting via Rich-Text Content
Meta
- CVSS:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC(5.7)
Problem
Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser do not consider all potentially malicious HTML tag & attribute combinations per default.
In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction.
In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.
Solution
Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above.
Custom package typo3/html-sanitizer - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios.
During the frontend rendering process, sanitization is applied to the default TypoScript path lib.parseFunc, which is implicitly used by the Fluid view-helper instruction f:format.html. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding ChangeLog documentation.
Credits
Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue.
References
- Record
GHSA-c5c9-8c6m-727v- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
- Record
CVE-2021-32768- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
- Record
CVE-2021-32768- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-c5c9-8c6m-727v
Cross-Site Scripting via Rich-Text Content
Meta
- CVSS:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC(5.7)
Problem
Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser do not consider all potentially malicious HTML tag & attribute combinations per default.
In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction.
In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.
Solution
Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above.
Custom package typo3/html-sanitizer - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios.
During the frontend rendering process, sanitization is applied to the default TypoScript path lib.parseFunc, which is implicitly used by the Fluid view-helper instruction f:format.html. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding ChangeLog documentation.
Credits
Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue.
References
- Record
GHSA-c5c9-8c6m-727v- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVBIT-typo3-2021-32768 No score
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
- Record
BIT-typo3-2021-32768- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
7.0.0 up to 7.6.53 | 7.6.53 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.42 | 8.7.42 |
typo3/cms-corePackagist |
10.0.0 up to 10.4.19 | 10.4.19 |
typo3/cms-corePackagist |
11.0.0 up to 11.3.2 | 11.3.2 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.29 | 9.5.29 |
typo3/cmsPackagist |
10.0.0 up to 10.4.19 | 10.4.19 |
typo3/cmsPackagist |
11.0.0 up to 11.3.2 | 11.3.2 |
typo3/cmsPackagist |
9.0.0 up to 9.5.29 | 9.5.29 |
typo3/cmsPackagist |
8.0.0 up to 8.7.42 | 8.7.42 |
typo3/cmsPackagist |
7.0.0 up to 7.6.53 | 7.6.53 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
typo3Bitnami |
7.0.0 up to 7.6.52, 8.0.0 up to 8.7.41, 9.0.0 up to 9.5.28, 10.0.0 up to 10.4.18, 11.0.0 up to 11.3.1 | 7.6.528.7.419.5.2810.4.1811.3.1 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.42, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 21 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.30v8.7.31v8.7.32v8.7.7v8.7.8v8.7.9 |
8.7.42 |
typo3/cms-corePackagist |
10.0.0 up to 10.4.19, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 20 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.2v10.4.3v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 |
10.4.19 |
typo3/cms-corePackagist |
11.0.0 up to 11.3.2, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0v11.3.1 |
11.3.2 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.29, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 33 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.17v9.5.18v9.5.19v9.5.2v9.5.20v9.5.21v9.5.22v9.5.23v9.5.24v9.5.25v9.5.26v9.5.27v9.5.28v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.29 |
typo3/cmsPackagist |
10.0.0 up to 10.4.19, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 20 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.2v10.4.3v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 |
10.4.19 |
typo3/cmsPackagist |
11.0.0 up to 11.3.2, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0v11.3.1 |
11.3.2 |
typo3/cmsPackagist |
9.0.0 up to 9.5.29, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 33 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.17v9.5.18v9.5.19v9.5.2v9.5.20v9.5.21v9.5.22v9.5.23v9.5.24v9.5.25v9.5.26v9.5.27v9.5.28v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.29 |
typo3/cmsPackagist |
8.0.0 up to 8.7.42, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 42 moreShow less8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.3v8.7.30v8.7.31v8.7.32v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 |
8.7.42 |
typo3/cmsPackagist |
7.0.0 up to 7.6.53, plus listed versions 7.0.17.0.27.1.07.2.07.3.0 Show 36 moreShow less7.3.17.4.07.5.07.6.07.6.17.6.107.6.117.6.127.6.137.6.147.6.157.6.167.6.177.6.187.6.197.6.27.6.37.6.47.6.57.6.67.6.77.6.87.6.9v7.6.20v7.6.21v7.6.22v7.6.23v7.6.24v7.6.25v7.6.26v7.6.27v7.6.28v7.6.29v7.6.30v7.6.31v7.6.32 |
7.6.53 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32768 is a medium vulnerability (CVSS 6.1) in Typo3, published August 10, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.73%, the 54th percentile. Fixed in typo3/cms-core 7.6.53.
References
typo3.org/security/advisory/typo3-core-sa-2021-013
github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-c5c9-8c6m-727v
nvd.nist.gov/vuln/detail/CVE-2021-32768