Vulnerability · Published Jun 9, 2026 · Assigned by TYPO3

CVE-2026-47348TYPO3 CMS - Cross-Site Scripting in Indexed Search

Medium 5.1

In plain English

A medium-severity cross-site scripting in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.1Medium

Exploit odds (30 days)0.3%top 80.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	typo3/cms-core	13.4.31	GHSA-cg75-qfg2-w9hj
Packagist	typo3/cms-core	14.3.3	GHSA-cg75-qfg2-w9hj
Packagist	typo3/cms-indexed-search	13.4.31	GHSA-cg75-qfg2-w9hj
Packagist	typo3/cms-indexed-search	14.3.3	GHSA-cg75-qfg2-w9hj

Affected products (as reported)

Vendor	Product	Versions
TYPO3	TYPO3 CMS	13.0.0 – before 13.4.3114.0.0 – before 14.3.3

Weakness: CWE-79 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N

References

https://typo3.org/security/advisory/typo3-core-sa-2026-010 vendor-advisory
Git commit of main branch patch
Git commit of 13.4 branch patch