CVE-2026-47348 is a Cross-Site Scripting vulnerability in TYPO3 CMS affecting versions 13.0.0 to 13.4.30 and 14.0.0 to 14.3.2. The issue arises because editors with content modification rights can include HTML markup in page titles, which are stored in the search index without sanitization. When these titles are rendered in frontend search results via the Indexed Search plugin, they are output without proper encoding, enabling injection of malicious scripts. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS 4.0 vector indicates network attack vector, low attack complexity, low privileges required, user interaction needed, and low impact on confidentiality, integrity, and availability.

An attacker with editor-level permissions can inject malicious HTML or scripts into page titles that appear in frontend search results. This can lead to Cross-Site Scripting attacks against users viewing those search results, potentially enabling session hijacking, defacement, or other client-side attacks. The impact is limited by the requirement for editor privileges and user interaction, and the overall severity is medium.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict editor permissions to trusted users only and consider disabling or restricting the Indexed Search plugin if feasible. Monitor vendor communications for updates on patches or official mitigations.