GHSA-4ppr-jw47-9qm5

TYPO3 Cross-Site Scripting in Link Handling

6.1 MediumFix available

It has been discovered that t3:// URL handling and typolink functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

What each source reports

GitHub Advisories Score used6.1

TYPO3 Cross-Site Scripting in Link Handling

Record: GHSA-4ppr-jw47-9qm5
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV6.1

TYPO3 Cross-Site Scripting in Link Handling

Record: GHSA-4ppr-jw47-9qm5
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`typo3/cms-core` Packagist	10.0.0 up to 10.2.1	10.2.1
`typo3/cms-core` Packagist	8.0.0 up to 8.7.30	8.7.30
`typo3/cms-core` Packagist	9.0.0 up to 9.5.12	9.5.12
`typo3/cms-core` Packagist	10.0.0 up to 10.2.1, plus listed versions v10.0.0v10.1.0v10.2.0	10.2.1
`typo3/cms-core` Packagist	8.0.0 up to 8.7.30, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 18 moreShow less v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.7v8.7.8v8.7.9	8.7.30
`typo3/cms-core` Packagist	9.0.0 up to 9.5.12, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 16 moreShow less v9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9	9.5.12

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-4ppr-jw47-9qm5 is a medium vulnerability (CVSS 6.1) in typo3/cms-core, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms-core 10.2.1.