TypiCMS Core, a multilingual CMS built on Laravel, contains a stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-27621. This vulnerability exists in the file upload module for versions prior to 16.1.7. Users with file upload permissions can upload SVG files, which are validated only by MIME type but not sanitized for embedded scripts. SVG files can contain JavaScript, and an attacker can craft an SVG payload that executes malicious code when viewed by other users, such as administrators, leading to session hijacking or other client-side attacks. Additionally, a parsing bug causes a 500 error if the SVG lacks a viewBox attribute, but this does not prevent exploitation since attackers can add a valid viewBox attribute. The vulnerability requires no authentication to exploit beyond file upload permissions and no user interaction beyond viewing the file. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required beyond upload rights, user interaction required (viewing), and high impact on confidentiality. The vulnerability is mitigated in version 16.1.7 of TypiCMS Core. No public exploits have been reported yet.

This vulnerability allows attackers to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, credential theft, or unauthorized actions performed with the victim's privileges. Since the vulnerability is stored XSS, it can persist and affect multiple users who access the malicious SVG file. Organizations using TypiCMS Core versions prior to 16.1.7 are at risk, especially if users with file upload permissions are untrusted or compromised. The impact is significant for administrative users who may have elevated privileges, increasing the risk of full system compromise. The vulnerability could also be used as a foothold for further attacks within the network or to spread malware. Although no known exploits are currently reported, the ease of exploitation and potential impact warrant prompt remediation.

Organizations should immediately upgrade TypiCMS Core to version 16.1.7 or later, which contains the fix for this vulnerability. Until the upgrade is applied, restrict file upload permissions to trusted users only and implement additional server-side validation and sanitization of SVG file contents to remove any embedded scripts. Employ Content Security Policy (CSP) headers to limit the execution of inline scripts and restrict sources of executable code. Monitor logs for unusual file uploads and access patterns related to SVG files. Consider disabling SVG uploads if not required. Conduct regular security audits of user-uploaded content and educate users about the risks of uploading untrusted files. Additionally, implement web application firewalls (WAFs) with rules to detect and block malicious SVG payloads.