{"action":"Upgrade typicms/core to 12.0.5 or later.","affected":[{"fixed":"16.1.7","introduced":"16.0.0"},{"fixed":"15.0.29","introduced":"15.0.0"},{"fixed":"14.0.27","introduced":"14.0.0"},{"fixed":"13.0.9","introduced":"13.0.0"},{"fixed":"12.0.5","introduced":"0"}],"component":"typicms/core","cve_ids":["CVE-2026-27621"],"ecosystem":"Packagist","epss":0.00224,"exploited":false,"fixed_versions":["16.1.7","15.0.29","14.0.27","13.0.9","12.0.5"],"ghsa_id":"GHSA-xfvg-8v67-j7wp","id":"tcs_01M5KFAZY08RA0R856E2WWN9R7","modified_at":"2026-07-09T17:30:10.868143556Z","published_at":"2026-02-25T16:06:59Z","references":["https://osv.dev/vulnerability/GHSA-xfvg-8v67-j7wp","https://github.com/TypiCMS/Core/security/advisories/GHSA-xfvg-8v67-j7wp","https://nvd.nist.gov/vuln/detail/CVE-2026-27621","https://github.com/TypiCMS/Core/commit/d480a0be1e8e7c0600bb9a325bb11920ee66497d","https://github.com/TypiCMS/Core"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-xfvg-8v67-j7wp","url":"https://osv.dev/vulnerability/GHSA-xfvg-8v67-j7wp"}],"summary":"TypiCMS Core has Stored Cross-Site Scripting (XSS) via SVG File Upload"}