GHSA-g4c9-qfvw-fmr4

TYPO3 Cross-Site Scripting in Backend Modal Component

6.1 MediumFix available

GHSA-g4c9-qfvw-fmr4 is a medium vulnerability (CVSS 6.1) in typo3/cms-core, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms-core 8.7.21.

What does this mean?

Severity: 6.1 MediumCVSS 3.1, GitHub Advisories
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 8.7.21typo3/cms-core +4 more

Description

Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Affected packages

Affected packages
Package	Affected	Fixed
`typo3/cms-core` Packagist	8.0.0 up to 8.7.21	8.7.21
`typo3/cms-core` Packagist	9.0.0 up to 9.5.2	9.5.2
`typo3/cms-core` Packagist	7.1.0 up to 7.6.32	7.6.32
`typo3/cms-core` Packagist	8.0.0 up to 8.7.21, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 9 moreShow less v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.7v8.7.8v8.7.9	8.7.21
`typo3/cms-core` Packagist	9.0.0 up to 9.5.2, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 6 moreShow less v9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1	9.5.2

What each source reports

GitHub Advisories Score used6.1

TYPO3 Cross-Site Scripting in Backend Modal Component

Record: GHSA-g4c9-qfvw-fmr4
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV6.1