8

CVE-2020-26216: Cross-Site Scripting in TYPO3 Fluid

Modified
Published 17-11-2020Last modified 04-08-2024

Vulnerability summary

CVE-2020-26216 is a high (CVSS 8.0) vulnerability in typo3 fluid. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 64% of scored vulnerabilities. 2 public exploits are recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
8.0/10
010
High · v3.1 (CVE.org)
EPSS score
1.04%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits2github, reference

Timeline

  1. 17-11-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

1.04%

Chance of exploitation in the next 30 days

Percentile

64%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.04% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

2 found
  • githubUnverified

    Fluid

    Maturity: poc

  • referenceUnverified

    Exploit Reference (typo3.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.

Typo31 product
  • fluid≥ 2.0.0, < 2.0.8 | < 2.0.8 | ≥ 2.1.0, < 2.1.7 | ≥ 2.2.0, < 2.2.4 | ≥ 2.3.0, < 2.3.7 | ≥ 2.4.0, < 2.4.4 | ≥ 2.5.0, < 2.5.11 | ≥ 2.6.0, < 2.6.10

1 vendor · 1 product

References

3 links