TypiCMS Core, a multilingual CMS based on Laravel, has a stored XSS vulnerability in its file upload module affecting versions before 16.1.7. The vulnerability occurs because SVG files uploaded by users with upload permissions are validated only by MIME type, but their content is not sanitized. An attacker can craft an SVG with embedded JavaScript that executes in the browser of any user who views the file, potentially compromising their session. A parsing bug causing a 500 error if the SVG lacks a viewBox attribute does not mitigate the risk, as attackers can include a valid viewBox. The issue is fixed in version 16.1.7.

Successful exploitation allows attackers to execute arbitrary JavaScript in the context of other users' browsers who view the malicious SVG file, leading to session compromise. This affects users with file upload permissions and any users who access the uploaded SVG files through the application. The vulnerability has a CVSS 4.0 score of 6.8 (medium severity), indicating a significant risk but requiring user interaction and limited privileges.

Upgrade TypiCMS Core to version 16.1.7 or later, where this vulnerability is fixed. The fix involves proper sanitization of SVG file contents to prevent embedded malicious scripts from executing. No other mitigations are indicated or substitute for applying the official patch.