GCVE-1-2025-0041: typo3

Vulnerability summary

GCVE-1-2025-0041 is a medium (CVSS 6.4) vulnerability in typo3.

Timeline

1. 19-12-2025
   PublishedVulnerability first disclosed.
2. 19-12-2025
   Last modifiedVulnerability information updated.

Description

The vulnerability, in a series (5) of online services in Luxembourg, occurs because a request parameter (e.g., a search or query parameter) is incorporated directly into the server-generated HTML response without proper escaping. As a result, specially crafted input containing HTML tags and attributes can be interpreted by the browser as active markup rather than plain text. An attacker can exploit this behavior by injecting HTML elements with JavaScript-capable event handlers. When the page is rendered and a user interacts with it (for example, through scrolling or other UI actions), the injected JavaScript executes within the security context of the vulnerable website. This is a reflected XSS issue, meaning the malicious payload is not stored server-side but is immediately reflected in the HTTP response to a single request. Successful exploitation requires a victim to follow a malicious link or otherwise load a request crafted by the attacker. Those vulnerabilities originated from a misconfiguration of the online service. **exclusively-hosted-service**

• CWE-79Improper Neutralization of Input During Web Page GenerationThe product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.