Typemill CVE-2026-120218

Requires an authenticated Typemill account with media/image upload capability (PR:L) and a second user who subsequently opens or renders the uploaded SVG (UI). The concrete flaw is in system/typemill/Models/SvgSanitizer.php in versions up to 2.26.0: the sanitizer permitted SVG files containing a DOCTYPE (DTD) declaration and did not strip XML processing instructions and comments, which per the patch can trigger XSLT transformations in browsers, yielding stored cross-site scripting. Limiting factors: exploitation is not possible without login and upload permission, it depends on a victim viewing the malicious SVG, and it only affects deployments running 2.26.0 or earlier; upgrading to 2.27.0 (which rejects DOCTYPE SVGs, loads with LIBXML_NONET, and removes processing-instruction/comment nodes) resolves it.

This is a moderate, not emergency, priority. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N, base 5.1) describes a network-reachable but privilege- and interaction-gated stored XSS: PR:L means the attacker must already hold an authenticated Typemill account able to upload media, and UI:P means a victim must subsequently render the malicious SVG. The vuln.today decision label is 'this_month' (routine patch cycle), not act_now or emergency, which is consistent with those limiting factors. It is NOT in CISA KEV, so there is no confirmed active exploitation. No EPSS score was provided, so exploitation probability cannot be quantified from this data. VulDB states an exploit has been published (E:P in the vector), but the only references are VulDB pages and the vendor patch - a public PoC reference exists; it is not verified as working exploit code. Signals are internally consistent (medium severity, authenticated+interaction-gated, no KEV, moderate decision label) rather than conflicting. Net: a real but bounded issue best handled in the normal monthly patch cycle, not a drop-everything emergency; the main risk is an authenticated low-privilege user escalating against higher-privileged users (e.g. an admin viewing the image) via stored script in the CMS.

An authenticated Typemill user with media-upload rights uploads a crafted SVG that, prior to 2.27.0, bypasses the SvgSanitizer because DOCTYPE/DTD declarations were permitted and XML processing instructions and comments were not stripped. When another user - for example an administrator browsing the media library or a page embedding the image - renders the SVG, attacker-controlled script executes in that victim's browser. A public PoC reference is cited by VulDB, though it is not verified as working exploit code.