Threat database

TypiCMS Core versions prior to 16.1.7 contain a stored Cross-Site Scripting (XSS) vulnerability in the file upload module. This flaw allows users with file upload permissions to upload SVG files containing malicious JavaScript, which executes when viewed by other users. The vulnerability arises because the SVG content is not sanitized despite MIME type validation. A bug in SVG parsing can cause errors but does not prevent exploitation. Version 16.1.7 addresses this issue.