CVE-2026-120218
Deferred Deferred - Pending Action

Cross-Site Scripting in Typemill CMS

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 2.27.0 is sufficient to resolve this issue. This patch is called 9ca43c4a7b6764c5a6ac11a2ccc099b036ee3cef. It is recommended to upgrade the affected component.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120218
EUVD
EUVD-2026-114786

Affected Vendors & Products

Showing 27 associated CPEs
Vendor Product Version / Range
n/a Typemill 2.0
n/a Typemill 2.1
n/a Typemill 2.2
n/a Typemill 2.3
n/a Typemill 2.4
n/a Typemill 2.5
n/a Typemill 2.6
n/a Typemill 2.7
n/a Typemill 2.8
n/a Typemill 2.9
n/a Typemill 2.10
n/a Typemill 2.11
n/a Typemill 2.12
n/a Typemill 2.13
n/a Typemill 2.14
n/a Typemill 2.15
n/a Typemill 2.16
n/a Typemill 2.17
n/a Typemill 2.18
n/a Typemill 2.19
n/a Typemill 2.20
n/a Typemill 2.21
n/a Typemill 2.22
n/a Typemill 2.23
n/a Typemill 2.24
n/a Typemill 2.25
n/a Typemill 2.26.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) flaw in Typemill CMS versions up to 2.26.0. It exists in the ControllerApiImage::saveImage function of the SvgSanitizer.php file. Attackers can exploit this by uploading manipulated SVG files, leading to malicious scripts executing in users' browsers. The issue arises from insufficient sanitization of SVG content, allowing injection of harmful code.

Detection Guidance

Check for Typemill installations running versions up to 2.26.0. Inspect SVG file handling in the system/typemill/Models/SvgSanitizer.php file for the vulnerable ControllerApiImage::saveImage function. Look for signs of XSS attempts in logs or user-uploaded SVG files containing DOCTYPE declarations or processing instructions.

Impact Analysis

If you use Typemill CMS versions up to 2.26.0, attackers could inject malicious scripts into your website via SVG uploads. This could lead to theft of user sessions, defacement of your site, or delivery of malware to visitors. The attack can be performed remotely without authentication, making it particularly dangerous.

Compliance Impact

This XSS vulnerability could violate GDPR's requirement for data security and user protection, as it may expose user data to unauthorized access. For HIPAA, it could compromise protected health information if medical content is hosted. Both regulations mandate protection against such attacks to ensure data integrity and confidentiality.

Mitigation Strategies
  • Upgrade Typemill to version 2.27.0 or later to apply the security patch.
  • Review and remove any existing SVG files containing DOCTYPE declarations or suspicious processing instructions.
  • Monitor network traffic and logs for signs of XSS attacks targeting SVG uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120218. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart