Cross-site scripting in Typemill SVG image saving
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting, Code execution
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79 and CWE-94.
Summary
Typemill up to 2.26.0 is affected. A flaw in the ControllerApiImage::saveImage function of SvgSanitizer.php lets crafted input inject script into web pages (CWE-79). A remote attacker with low privileges can trigger it. A public exploit has been published.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 2.27.0 is sufficient to resolve this issue. This patch is called 9ca43c4a7b6764c5a6ac11a2ccc099b036ee3cef. It is recommended to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Typemill | 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14; 2.15; 2.16; 2.17; 2.18; 2.19; 2.20; 2.21; 2.22; 2.23; 2.24; 2.25; 2.26.0 | 2.27.0 | Patch available | CNA |
- Typemill Vendor— Affected 2.0; 2.1; 2.2; 2.3; 2.4; 2.5; 2.6; 2.7; 2.8; 2.9; 2.10; 2.11; 2.12; 2.13; 2.14; 2.15; 2.16; 2.17; 2.18; 2.19; 2.20; 2.21; 2.22; 2.23; 2.24; 2.25; 2.26.0 Fixed in 2.27.0 Patch available CNA
Remediation
Upgrade Typemill to version 2.27.0, which fixes the issue. The fix is patch 9ca43c4a7b6764c5a6ac11a2ccc099b036ee3cef.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA Typemill Fixed in 2.27.0
Timeline
- 2026-11-01 Threatist record created from CVE-2026-120218
- 2026-11-01 Alias added: GHSA-wh4p-gf4j-mjqc
- 2026-11-06 CISA SSVC decision points changed
- 2026-11-06 Priority changed: LOW → MEDIUM
References
Sources
- CVE-2026-120218 · CVE Program
- CVE-2026-120218 · NVD
- FIRST EPSS
- GHSA-wh4p-gf4j-mjqc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences