Read the docs
TI-2020-16037 Aliases CVE-2020-26216GHSA-hpjm-3ww5-6cpf

Cross-Site Scripting in TYPO3 Fluid

Priority LOW 37CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory.

Why it matters now

EPSS 0.01039 64th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Fluid (TYPO3): 2.0.8, 2.1.7, 2.2.4 +4typo3fluid/fluid (Packagist): 2.0.8, 2.1.7, 2.2.4 +4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3Fluid2.0.0 to before 2.0.8; 2.1.0 to before 2.1.7; 2.2.0 to before 2.2.4; 2.3.0 to before 2.3.7; 2.4.0 to before 2.4.4; 2.5.0 to before 2.5.11; 2.6.0 to before 2.6.102.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11, 2.6.10Patch availableCNA
—typo3fluid/fluid (Packagist)2.0.0 to before 2.0.82.0.8Patch availableGHSA-hpjm-3ww5-6cpf
—typo3fluid/fluid (Packagist)2.1.0 to before 2.1.72.1.7Patch availableGHSA-hpjm-3ww5-6cpf
—typo3fluid/fluid (Packagist)2.2.0 to before 2.2.42.2.4Patch availableGHSA-hpjm-3ww5-6cpf
—typo3fluid/fluid (Packagist)2.3.0 to before 2.3.72.3.7Patch availableGHSA-hpjm-3ww5-6cpf
—typo3fluid/fluid (Packagist)2.4.0 to before 2.4.42.4.4Patch availableGHSA-hpjm-3ww5-6cpf
—typo3fluid/fluid (Packagist)2.5.0 to before 2.5.112.5.11Patch availableGHSA-hpjm-3ww5-6cpf
—typo3fluid/fluid (Packagist)2.6.0 to before 2.6.102.6.10Patch availableGHSA-hpjm-3ww5-6cpf
  • Fluid VendorTYPO3 Affected 2.0.0 to before 2.0.8; 2.1.0 to before 2.1.7; 2.2.0 to before 2.2.4; 2.3.0 to before 2.3.7; 2.4.0 to before 2.4.4; 2.5.0 to before 2.5.11; 2.6.0 to before 2.6.10 Fixed in 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11, 2.6.10 Patch available CNA
  • typo3fluid/fluid (Packagist) Vendor— Affected 2.0.0 to before 2.0.8 Fixed in 2.0.8 Patch available GHSA-hpjm-3ww5-6cpf
  • typo3fluid/fluid (Packagist) Vendor— Affected 2.1.0 to before 2.1.7 Fixed in 2.1.7 Patch available GHSA-hpjm-3ww5-6cpf
  • typo3fluid/fluid (Packagist) Vendor— Affected 2.2.0 to before 2.2.4 Fixed in 2.2.4 Patch available GHSA-hpjm-3ww5-6cpf
  • typo3fluid/fluid (Packagist) Vendor— Affected 2.3.0 to before 2.3.7 Fixed in 2.3.7 Patch available GHSA-hpjm-3ww5-6cpf
  • typo3fluid/fluid (Packagist) Vendor— Affected 2.4.0 to before 2.4.4 Fixed in 2.4.4 Patch available GHSA-hpjm-3ww5-6cpf
  • typo3fluid/fluid (Packagist) Vendor— Affected 2.5.0 to before 2.5.11 Fixed in 2.5.11 Patch available GHSA-hpjm-3ww5-6cpf
  • typo3fluid/fluid (Packagist) Vendor— Affected 2.6.0 to before 2.6.10 Fixed in 2.6.10 Patch available GHSA-hpjm-3ww5-6cpf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:typo3:fluid:*:*:*:*:*:*:*:*before 2.0.8; 2.1.0 to before 2.1.7; 2.2.0 to before 2.2.4; 2.3.0 to before 2.3.7; 2.4.0 to before 2.4.4; 2.5.0 to before 2.5.11; 2.6.0 to before 2.6.10VulnerableTYPO3
  • cpe:2.3:a:typo3:fluid:*:*:*:*:*:*:*:* Versions before 2.0.8; 2.1.0 to before 2.1.7; 2.2.0 to before 2.2.4; 2.3.0 to before 2.3.7; 2.4.0 to before 2.4.4; 2.5.0 to before 2.5.11; 2.6.0 to before 2.6.10 Vulnerable ·TYPO3

Remediation

  • Fix · CNA Fluid (TYPO3) Fixed in 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11, 2.6.10
  • Fix · GHSA-hpjm-3ww5-6cpf typo3fluid/fluid (Packagist) Fixed in 2.0.8 Advisory →
  • Fix · GHSA-hpjm-3ww5-6cpf typo3fluid/fluid (Packagist) Fixed in 2.1.7 Advisory →
  • Fix · GHSA-hpjm-3ww5-6cpf typo3fluid/fluid (Packagist) Fixed in 2.2.4 Advisory →
  • Fix · GHSA-hpjm-3ww5-6cpf typo3fluid/fluid (Packagist) Fixed in 2.3.7 Advisory →
  • Fix · GHSA-hpjm-3ww5-6cpf typo3fluid/fluid (Packagist) Fixed in 2.4.4 Advisory →
  • Fix · GHSA-hpjm-3ww5-6cpf typo3fluid/fluid (Packagist) Fixed in 2.5.11 Advisory →
  • Fix · GHSA-hpjm-3ww5-6cpf typo3fluid/fluid (Packagist) Fixed in 2.6.10 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26216
  2. 2026-10-03 Alias added: GHSA-hpjm-3ww5-6cpf

References

Exploit 2

Patch 1

Advisory 1

Other 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences