Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

typo3/cms-fluid

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.1PackagistPublished

    TYPO3 Cross-Site Scripting in Fluid ViewHelpers

    GHSA-22q7-cg4r-p9mx

    Affected
    • Packagist typo3/cms-fluid >= 8.0.0, < 8.7.23; >= 9.0.0, < 9.5.4
    Fixed in
    8.7.239.5.4· Vendor fix available
    Issue
    Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting.

    Recommended action: Upgrade to 9.5.4 or 8.7.23 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 6.1PackagistPublished

    TYPO3 vulnerable to Cross-Site Scripting in the textarea view helper

    CVE-2010-3672 · GHSA-p78x-93mq-qwqh

    Affected
    • Packagist typo3/cms-fluid < 4.3.4; >= 4.4.0, < 4.4.1
    Fixed in
    4.4.14.3.4· Vendor fix available
    Issue
    TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension.

    Recommended action: Upgrade to 4.4.1 or 4.3.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →