{"id":"CVE-2020-15241","aliases":["BIT-typo3-2020-15241","EUVD-2020-1418","GHSA-7733-hjv6-4h47"],"status":"published","title":"Cross-Site Scripting in TYPO3 Fluid Engine","description":"TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00966,"percentile":0.62154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601","CWE-79"],"published":"2020-10-08T19:55:53Z","modified":"2026-10-24T10:51:22Z","fixes":[{"ecosystem":"Packagist","package":"typo3fluid/fluid","fixed_in":["2.0.5","2.1.4","2.2.1","2.3.5","2.4.1","2.5.5","2.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"typo3/cms-core","fixed_in":["8.7.25","9.5.6"],"sources":["ghsa","osv"]},{"ecosystem":"Packagist","package":"typo3/cms","fixed_in":["8.7.25","9.5.6"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.4"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.1"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.7.25"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.5.6"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.7.25"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.5.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"typo3","ranges":[{"type":"SEMVER","events":[{"introduced":"8.7.25"},{"last_affected":"8.7.25"},{"introduced":"9.5.6"},{"last_affected":"9.5.6"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.5"}]}],"versions":["2.0.0","2.0.1","2.0.2","2.0.3","2.0.4"]},{"source":"osv","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.4"}]}],"versions":["2.1.0","2.1.1","2.1.2","2.1.3"]},{"source":"osv","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.1"}]}],"versions":["2.2.0"]},{"source":"osv","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.5"}]}],"versions":["2.3.0","2.3.1","2.3.2","2.3.3","2.3.4"]},{"source":"osv","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}],"versions":["2.4.0"]},{"source":"osv","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.5"}]}],"versions":["2.5.0","2.5.1","2.5.2","2.5.3","2.5.4"]},{"source":"osv","ecosystem":"Packagist","package":"typo3fluid/fluid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.1"}]}],"versions":["2.6.0"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.7.25"}]}],"versions":["v8.7.10","v8.7.11","v8.7.12","v8.7.13","v8.7.14","v8.7.15","v8.7.16","v8.7.17","v8.7.18","v8.7.19","v8.7.20","v8.7.21","v8.7.22","v8.7.23","v8.7.24","v8.7.7","v8.7.8","v8.7.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.5.6"}]}],"versions":["v9.0.0","v9.1.0","v9.2.0","v9.2.1","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.4.0","v9.5.0","v9.5.1","v9.5.2","v9.5.3","v9.5.4","v9.5.5"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"fixed":"8.7.25"}]}],"versions":["8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.2.1","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.6.0","8.6.1","8.7.0","8.7.1","8.7.2","v8.7.10","v8.7.11","v8.7.12","v8.7.13","v8.7.14","v8.7.15","v8.7.16","v8.7.17","v8.7.18","v8.7.19","v8.7.20","v8.7.21","v8.7.22","v8.7.23","v8.7.24","v8.7.3","v8.7.4","v8.7.5","v8.7.6","v8.7.7","v8.7.8","v8.7.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.5.6"}]}],"versions":["v9.0.0","v9.1.0","v9.2.0","v9.2.1","v9.3.0","v9.3.1","v9.3.2","v9.3.3","v9.4.0","v9.5.0","v9.5.1","v9.5.2","v9.5.3","v9.5.4","v9.5.5"]}],"products":[{"vendor":"fluid-cloudnative","product":"fluid"},{"vendor":"typo3","product":"fluid"},{"vendor":"typo3","product":"fluid_engine"},{"vendor":"typo3","product":"typo3"}],"references":[{"url":"https://github.com/TYPO3/Fluid/security/advisories/GHSA-7733-hjv6-4h47","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Third Party Advisory","web","evidence"]},{"url":"https://github.com/TYPO3/Fluid/commit/9ef6a8ffff2e812025fc0701b4ce72eea6911a3d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web","fix"]},{"url":"https://typo3.org/security/advisory/typo3-core-sa-2019-013","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web","evidence"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15241","tags":["advisory"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2020-15241.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2020-15241.yaml","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3fluid/fluid/CVE-2020-15241.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-7733-hjv6-4h47"},{"url":"https://github.com/TYPO3/Fluid","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2020-15241","title":"Cross-Site Scripting in TYPO3 Fluid Engine","description":"TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).","status":"published","published":"2020-10-08T20:15:17Z","modified":"2024-08-04T13:08:22.895Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-1418","description":"TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).","status":"published","published":"2020-10-08T20:15:17Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"ghsa":[{"id":"GHSA-7733-hjv6-4h47","title":"Cross-Site Scripting in ternary conditional operator","description":"\u003e ### Meta\n\u003e * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0)\n\u003e * CWE-79\n\n---\n\n:information_source: \u0026nbsp;This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020\n\n---\n\n### Problem\nIt has been discovered that the Fluid Engine (package `typo3fluid/fluid`) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.\n\n```\n{showFullName ? fullName : defaultValue}\n```\n\n### Solution\nUpdate to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this `typo3fluid/fluid` package that fix the problem described.\n\nUpdated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) releases:\n* TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.5)\n* TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1)\n\n### Credits\nThanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2019-013](https://typo3.org/security/advisory/typo3-core-sa-2019-013)","status":"published","published":"2020-10-08T19:55:53Z","modified":"2024-02-01T18:55:14Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-601"],"updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2020-15241","description":"TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).","status":"published","published":"2020-10-08T21:15:10.167Z","modified":"2026-06-17T02:56:20.487Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T14:06:19.351389Z"}],"osv":[{"id":"CVE-2020-15241","description":"TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).","status":"published","published":"2020-10-08T21:15:10.167Z","modified":"2026-10-24T10:51:22.163664464Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"GHSA-7733-hjv6-4h47","title":"Cross-Site Scripting in ternary conditional operator","description":"\u003e ### Meta\n\u003e * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0)\n\u003e * CWE-79\n\n---\n\n:information_source: \u0026nbsp;This vulnerability has been fixed in May 2019 already, CVE and GHSA were assigned later in October 2020\n\n---\n\n### Problem\nIt has been discovered that the Fluid Engine (package `typo3fluid/fluid`) is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like the following.\n\n```\n{showFullName ? fullName : defaultValue}\n```\n\n### Solution\nUpdate to versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 of this `typo3fluid/fluid` package that fix the problem described.\n\nUpdated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) releases:\n* TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.5)\n* TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1)\n\n### Credits\nThanks to Bill Dagou who reported this issue and to TYPO3 core merger Claus Due who fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2019-013](https://typo3.org/security/advisory/typo3-core-sa-2019-013)","status":"published","published":"2020-10-08T19:55:53Z","modified":"2026-09-10T03:48:59.130146974Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601","CWE-79"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"BIT-typo3-2020-15241","description":"TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like `{showFullName ? fullName : defaultValue}`. Updated versions of this package are bundled in following TYPO3 (`typo3/cms-core`) versions as well: TYPO3 v8.7.25 (using `typo3fluid/fluid` v2.5.4) and TYPO3 v9.5.6 (using `typo3fluid/fluid` v2.6.1).","status":"published","published":"2024-03-06T11:11:41.387Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:36.104787Z"}]}}