Read the docs

typemill

Records7All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high3CVSS 7.0–8.9

Exploited now

typemill records in CISA KEV

No typemill vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Typemill 2 records MEDIUM

Records

7 records

TI-2026-50117 CVE-2026-71518 · GHSA-rw94-73mp-v8hw

Typemill < 2.26.0 Authorization Bypass via Media File Download Route

Priority MEDIUM 44

Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00511 Published 2026-08-17 Fixed in 2.26.0 CWE-863
TI-2026-36348 CVE-2026-49133 · GHSA-pvj2-mj22-xxmq

Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()

Priority LOW 31

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in th…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00343 Published 2026-06-17 Fixed in 2.24.0 CWE-22
TI-2026-32346 CVE-2026-44401 · GHSA-8vfw-vh7q-p649

Typemill CMS 2.x Persistent XSS via Markdown javascript URI

Priority LOW 21

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by su…

CVSS 4.0MEDIUM 4.6 Network High privileges User interaction EPSS 0.0032 Published 2026-08-10 No fix listed CWE-79
Open these records in search →