CVE-2020-16095

Cross-site Scripting vulnerability in Kitodo.Presentation

6.1 MediumFix available

The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.87%Up 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.

Record: CVE-2020-16095
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.

Record: CVE-2020-16095
Updated: 2026-11-02

EUVDEUVD-2020-0555 No score

The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.

Record: EUVD-2020-0555
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fpqv-x9hm-35j9 6.1

Cross-site Scripting vulnerability in Kitodo.Presentation

Impact

Kitodo.Presentation fails to properly encode URL parameters for output in HTML making it vulnerable to Cross Site Scripting (XSS). Only sites using the ListView, Navigation or PageView plugins are affected.

It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site Scripting, although there is currently no known way to exploit this in Kitodo.Presentation.

Patches

An updated version of Kitodo.Presentation is available on GitHub, Packagist and in the TYPO3 Extension Repository. Users are advised to update as soon as possible.

The issue was also fixed in release 2.3.1 of the 2.x branch, although it is generally not recommended to run this branch since it depends on an outdated TYPO3 version.

References

TYPO3 Security Advisory TYPO3-EXT-SA-2020-015 jQuery Security Advisory GHSA-gxr4-xjj5-5px2 Open Bug Bounty Report OBB-1219978

Contact

If you have any questions or comments about this advisory:

Open an issue
Email us at [email protected]

Record: GHSA-fpqv-x9hm-35j9
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

The dlf (aka Kitodo.Presentation) extension before 3.1.2 for TYPO3 allows XSS.

Record: CVE-2020-16095
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-fpqv-x9hm-35j9 6.1

Cross-site Scripting vulnerability in Kitodo.Presentation

Impact

It also includes jQuery 3.4.1 which is known to be vulnerable against Cross Site Scripting, although there is currently no known way to exploit this in Kitodo.Presentation.

Patches

An updated version of Kitodo.Presentation is available on GitHub, Packagist and in the TYPO3 Extension Repository. Users are advised to update as soon as possible.

The issue was also fixed in release 2.3.1 of the 2.x branch, although it is generally not recommended to run this branch since it depends on an outdated TYPO3 version.

References

TYPO3 Security Advisory TYPO3-EXT-SA-2020-015 jQuery Security Advisory GHSA-gxr4-xjj5-5px2 Open Bug Bounty Report OBB-1219978

Contact

If you have any questions or comments about this advisory:

Open an issue
Email us at [email protected]

Record: GHSA-fpqv-x9hm-35j9
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

kitodo kitodo.presentation

Affected packages

Affected packages
Package	Affected	Fixed
`kitodo/presentation` Packagist	before 3.1.2	3.1.2
`kitodo/presentation` Packagist	before 3.1.2, plus listed versions v2.3.0v2.3.1v2.3.2v3.0.0v3.0.0-beta.1v3.0.1v3.1.0v3.1.1	3.1.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-16095 is a medium vulnerability (CVSS 6.1) in Kitodo Kitodo.presentation, published July 29, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.87%, the 58th percentile. Fixed in kitodo/presentation 3.1.2.