CVE-2026-27621
1 advisory.
Packagist/typicms/core CVE-2026-27621: medium, EPSS 0.31%
TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload
Action: Upgrade typicms/core to 12.0.5 or later.
composer require typicms/core:16.1.7composer require typicms/core:15.0.29composer require typicms/core:14.0.27composer require typicms/core:13.0.9composer require typicms/core:12.0.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 16.0.0 | 16.1.7 | - |
| 15.0.0 | 15.0.29 | - |
| 14.0.0 | 14.0.27 | - |
| 13.0.0 | 13.0.9 | - |
| 0 | 12.0.5 | - |
Fixed versions
| 16.1.7 | 15.0.29 | 14.0.27 | 13.0.9 | 12.0.5 |
Sources
- osv: GHSA-xfvg-8v67-j7wp
- https://github.com/TypiCMS/Core/security/advisories/GHSA-xfvg-8v67-j7wp
- https://nvd.nist.gov/vuln/detail/CVE-2026-27621
- https://github.com/TypiCMS/Core/commit/d480a0be1e8e7c0600bb9a325bb11920ee66497d
- https://github.com/TypiCMS/Core
CVE-2026-27621 · published · modified · JSON