EUVD-2026-35191
GHSA-jvf5-rxvv-3mcg
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (TYPO3) · only source for this CVE.
CVSS VectorVendor: TYPO3
Lifecycle Timeline
3DescriptionCVE.org
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.
AnalysisAI
XSS sanitizer bypass in typo3/html-sanitizer before 2.3.2 allows authenticated low-privileged users to inject unsanitized HTML by exploiting a parser divergence between the Masterminds HTML5 tokenizer and browser behavior for whitespace-variant closing tags such as </style\t>. The vulnerability is gated behind the non-default ALLOW_INSECURE_RAW_TEXT configuration flag, substantially limiting exposure. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Technical ContextAI
The root cause (CWE-79) is a parser inconsistency in the rawText() method of the Masterminds HTML5 tokenizer, which typo3/html-sanitizer used internally prior to version 2.3.2. The HTML5 specification (§ 8.2.6.1) permits optional whitespace between a raw-text closing tag name and the terminating '>' character, making </style\t> a syntactically valid end tag. The Masterminds tokenizer's rawText() searched only for the literal sequence '</style>' without consuming trailing whitespace, so it failed to detect </style\t> as a closing tag and treated subsequent content as still inside the raw-text element. Browsers, being compliant with the HTML5 spec, correctly parse </style\t> as the closing tag, causing content injected after it to execute as normal HTML rather than raw text. The fix (commit bd1a88d9) introduces a custom TYPO3\HtmlSanitizer\Parser\Tokenizer subclass that mirrors the existing rcdata() whitespace-handling behavior in rawText(), and a custom Html5 parser class that wires this fixed tokenizer into the sanitization pipeline. All versions matching CPE cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:* before 2.3.2 are affected.
RemediationAI
Upgrade to typo3/html-sanitizer 2.3.2 or later, which resolves the issue by introducing a custom Tokenizer subclass (src/Parser/Tokenizer.php) that correctly handles whitespace-variant closing tags per HTML5 spec § 8.2.6.1, eliminating the parser divergence with browsers. The patch commit is bd1a88d9b5a5f67f1120ec41084e9c1a0675641c (https://github.com/TYPO3/html-sanitizer/commit/bd1a88d9b5a5f67f1120ec41084e9c1a0675641c), and the vendor advisory is at https://typo3.org/security/advisory/typo3-core-sa-2026-006. If an immediate upgrade is not feasible, disabling the ALLOW_INSECURE_RAW_TEXT configuration option eliminates the vulnerable code path entirely and is the recommended compensating control; however, this may break application functionality that depends on passing raw HTML through the sanitizer, so operators should audit usage before disabling it. No other workaround is known that preserves ALLOW_INSECURE_RAW_TEXT while closing the bypass.
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax th
Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php i
Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbi
The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, w
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers t
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. Rated medium
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 6.1), this vulnerability is
TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting.
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vul
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cr
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today