Typemill CMS EUVD-2026-64169

Exploitation requires a valid Typemill account with permission to edit page metadata - specifically the og:title and og:description fields. This corresponds to PR:L (low-privilege authenticated access) in the CVSS vector; anonymous or unauthenticated access is explicitly insufficient. Beyond account access, a separate victim must load the affected page in their browser (UI:R), making this a two-party stored XSS rather than a self-executing attack. The description further notes that XSS execution depends on 'certain browser or DOM interaction scenarios,' implying payload trigger is not guaranteed across all browsers or rendering environments. Exploitation is limited by: authentication requirement for the injecting party, metadata editing permission scope within Typemill's role model, and browser-dependent execution conditions for the stored payload.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) scores 4.6, accurately reflecting a network-reachable attack surface constrained by two significant limiting factors: the attacker must hold a low-privilege authenticated account (PR:L), and a victim must load the affected page (UI:R). Scope is unchanged (S:U), and impact is limited to partial confidentiality and integrity - no availability risk. No EPSS score was provided in the source data, preventing a probabilistic exploitation forecast. Active exploitation is not confirmed: this CVE does not appear in CISA KEV and no public exploit code was referenced. The stored nature of the injection distinguishes it from lower-risk reflected variants - a single successful injection persists and affects all subsequent visitors, meaning even organizations managing modest Typemill deployments should prioritize patching over deferral. The PR:L prerequisite is the primary exploitation barrier; in multi-author Typemill sites where content editors are loosely managed, this barrier is reduced.

An authenticated Typemill content editor with metadata editing rights navigates to a page's settings and injects a malicious HTML attribute (such as an event handler) into the og:title or og:description field, which Typemill writes to persistent storage without encoding. When any site visitor subsequently loads that page and triggers the DOM condition (e.g., hovering over or interacting with the meta-tag-rendered element), the injected script executes in their browser, potentially harvesting session tokens or performing actions under their identity. No public exploit code has been identified at time of analysis.