TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)

Metadata

Affected Target

Summary

TypiCMS Core allows users with file-upload permission to upload SVG files, validating only the MIME type without sanitizing the SVG’s internal content. Because SVG is an XML-based format that can embed <script> tags, an attacker can upload a malicious SVG containing JavaScript that executes whenever a victim (such as an administrator) views or accesses the file directly. A parsing bug in TypiCMS also causes a 500 error on SVGs lacking a viewBox attribute, but this is trivially bypassed by including a valid viewBox in the crafted payload. Since uploaded files are typically stored on the public disk, the malicious SVG becomes reachable via a direct, publicly accessible URL.

Vulnerability Details

Root Cause

FileFormRequest whitelists svg as an allowed upload MIME type, and FileUploader stores the file content as-is without parsing out dangerous elements (<script>, event handler attributes such as on*), enabling stored Cross-Site Scripting (CWE-79).

Attack Vector

1. Craft a malicious SVG file containing a <script> tag (e.g., reading document.cookie) and a valid viewBox attribute to avoid triggering the unrelated parser bug.
2. Log in to the TypiCMS admin panel as a user with file-upload permission and upload the SVG via the Files module (/admin/files).
3. TypiCMS stores the file and exposes it at a public URL such as http://<site>/storage/files/malicious.svg.
4. Send the link to a privileged user (e.g., an administrator); when they open it directly, the embedded JavaScript executes in their browser session, allowing forged authenticated actions, data exfiltration, or UI manipulation (fake login prompts, keylogging).

Impact

Even though HttpOnly cookies prevent direct session-cookie theft, the attacker’s script can perform authenticated actions as the victim (e.g., creating a new admin account, changing credentials, deleting content) and read/exfiltrate sensitive admin-panel data, amounting to full application compromise when a privileged user is targeted.

Environment / Lab Setup

Target:   TypiCMS Core <= 16.0.5 with public filesystem disk configured for uploads
Attacker: Any modern web browser; a TypiCMS account with file-upload permission

Proof of Concept

PoC Script

See malicious.svg in this folder (payload extracted from the source README).

Uploading this SVG through the Files module and then navigating to its public URL executes the embedded <script> in the viewer’s browser session, demonstrating the stored XSS (the PoC payload shows a cookie-revealing alert() as evidence).

Detection & Indicators of Compromise

Signs of compromise:

• SVG files in the public uploads directory containing embedded <script> tags or JS event handlers.
• Unexplained new administrator accounts, changed credentials, or content modifications shortly after an admin views a shared file link.
• Outbound network requests from admin sessions to unfamiliar third-party domains (exfiltration).

Remediation

References

• Source repository

Notes

Mirrored from https://github.com/lukasz-rybak/CVE-2026-27621 on 2026-07-05.