CVE-2026-44401

Received Received - Intake

Persistent XSS in Typemill CMS Markdown Parser

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdown links using the javascript: scheme through ParsedownExtension.php or TwigMarkdownExtension.php, storing a persistent payload that executes in the browser of every visitor who clicks the link, enabling session cookie theft, authenticated request forgery, and credential harvesting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-10

Generated

2026-08-11

AI Q&A

2026-08-11

EPSS Evaluated

N/A

NVD

CVE-2026-44401

EUVD

EUVD-2026-55793

Affected Vendors & Products

Vendor	Product	Version / Range
typemill	cms	2.*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

Typemill CMS version 2.x has a persistent cross-site scripting (XSS) vulnerability in its Markdown parser. Authenticated users with theme-configuration privileges can inject malicious JavaScript URIs by inserting unsanitized href values in Markdown links. The vulnerability exists in ParsedownExtension.php or TwigMarkdownExtension.php, allowing attackers to store persistent payloads that execute when clicked by other users.

Detection Guidance

Detecting this vulnerability requires manual inspection of Markdown links in Typemill CMS theme configurations. Check for unsanitized javascript: URIs in href values within Markdown files or database entries. Review ParsedownExtension.php and TwigMarkdownExtension.php for improper input validation. Inspect browser console logs for unexpected JavaScript execution when viewing pages.

Impact Analysis

This vulnerability can lead to session cookie theft, allowing attackers to hijack user accounts. It also enables authenticated request forgery, where attackers can perform actions on behalf of users, and credential harvesting through malicious links. Visitors clicking infected links risk browser-based attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, such as session cookies or user credentials, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. The persistent nature of the XSS attack increases the risk of prolonged exposure and potential non-compliance with these regulations.

Mitigation Strategies

Immediately update Typemill CMS to the latest patched version. Disable theme-configuration access for non-admin users. Implement strict input validation for Markdown links, blocking javascript: URIs. Sanitize all href values before rendering. Monitor network traffic for suspicious JavaScript execution patterns.

Hi! I’m here to help you understand CVE-2026-44401. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70