CVE-2021-36787
Cross-site Scripting in the femanager TYPO3 extension
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
- Record
CVE-2021-36787- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
- Record
CVE-2021-36787- Updated
- 2026-11-02
EUVDEUVD-2021-2048 No score
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
- Record
EUVD-2021-2048- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f3rf-v9qm-9c89 No score
Cross-site Scripting in the femanager TYPO3 extension
The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.
Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.
- Record
GHSA-f3rf-v9qm-9c89- Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document.
- Record
CVE-2021-36787- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-f3rf-v9qm-9c89 No score
Cross-site Scripting in the femanager TYPO3 extension
The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.
Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.
- Record
GHSA-f3rf-v9qm-9c89- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
in2code/femanagerPackagist |
before 5.5.1 | 5.5.1 |
in2code/femanagerPackagist |
6.0.0 up to 6.3.1 | 6.3.1 |
in2code/femanagerPackagist |
before 5.5.1, plus listed versions 2.5.02.5.12.6.02.6.12.6.2 Show 31 moreShow less2.7.03.0.03.0.13.0.23.1.03.1.13.1.23.1.33.2.03.3.04.0.04.0.14.0.24.1.04.1.14.2.04.2.14.2.24.2.34.2.44.2.55.0.05.1.05.1.15.2.05.3.05.3.15.4.05.4.15.4.25.5.0 |
5.5.1 |
in2code/femanagerPackagist |
6.0.0 up to 6.3.1, plus listed versions 6.0.16.1.06.1.16.1.26.2.06.2.16.3.0 |
6.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-36787 is a medium vulnerability (CVSS 5.4) in In2code Femanager, published August 13, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.33%, the 71st percentile. Fixed in in2code/femanager 5.5.1.
References
typo3.org/help/security-advisories/security
seclists.org/fulldisclosure/2022/Jan/53
packetstormsecurity.com/files/165675/TYPO3-femanager-6.3.0-Cross-Site-Scripting.html
nvd.nist.gov/vuln/detail/CVE-2021-36787
github.com/in2code-de/femanager/commit/70f873c60f0e40ffd6a1300218ca368156fc1bf2