TYPO3 CMS EUVD-2026-35395

Exploitation requires an authenticated TYPO3 backend account with at least editor-level privileges sufficient to create or modify page records (PR:L in CVSS 4.0 confirms low-privilege authentication is required - unauthenticated exploitation is not possible). The EXT:indexed_search (Indexed Search) system extension must be installed and actively rendering search results on the frontend; sites using alternative search solutions (e.g., EXT:solr, EXT:elasticsearch) are not affected by this specific code path. A frontend user must perform a search query that returns the malicious page title in results (UI:P - passive interaction). Limiting factors for defenders: the attacker must hold valid TYPO3 backend credentials, the site must be using EXT:indexed_search on the frontend, and exploitation is bounded to users who trigger the search results page containing the injected title. Non-default installations that have replaced or disabled Indexed Search are not exposed.

The CVSS 4.0 score of 5.1 (Medium) is consistent with a stored XSS that requires low privileges (PR:L - editor-level backend access) and passive user interaction (UI:P - a frontend visitor must load a search results page). The stored persistence amplifies real-world impact relative to reflected XSS: a single editorial action can silently affect many frontend users until the malicious title is discovered and removed. Attack complexity is low (AC:L) with no special attack requirements (AT:N), meaning exploitation requires no race conditions or unusual configurations beyond editor credentials and the Indexed Search extension being active. The CVSS 4.0 impact metrics reflect limited scope: low confidentiality and integrity impact on the vulnerable system (VC:L/VI:L), no availability impact, and low integrity impact on subsequent systems (SI:L). No EPSS score was provided in the input data. No KEV listing and no public exploit identified at time of analysis, suggesting opportunistic exploitation is not yet occurring at scale. The most realistic threat actor is a malicious or compromised TYPO3 editor account - an insider or an attacker who has already obtained backend credentials through phishing or credential stuffing.

An attacker who has obtained TYPO3 backend editor credentials - via phishing, credential stuffing, or a compromised account - navigates to any page record and sets its title to a string containing a JavaScript payload such as an XSS cookie-stealer. Once the page is crawled and the title is written to the indexed_search index without sanitization, every frontend visitor who performs a search returning that page as a result will have the payload execute silently in their browser. No public proof-of-concept code is identified at time of analysis, but the vulnerability class is elementary and the fix (addition of a single htmlspecialchars() call) confirms the unsanitized output path was straightforward to reach.