Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

CVE-2021-32768 — cms-core

MEDIUM

CVE-2021-32768 is a medium-severity (CVSS 6.1) Cross-site Scripting (XSS) vulnerability in typo3/cms-core. A fix is available for typo3/cms-core — see the affected versions and patch details below.

Cross-Site Scripting via Rich-Text Content

Also known asBIT-typo3-2021-32768GHSA-c5c9-8c6m-727v
Published
Updated
Affected
10 pkgs
Patched
10 / 10
Exploits
None indexed
Exploitation data as of Oct 9, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

EPSS Exploitation Probability

via FIRST.org ↗
0.7%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs53th percentile — riskier than 53% of all scored CVEsHighest risk
0.00%0.41%0.82%1.23%0.3%0.7%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2021-32768 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 385,738 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.

Real-World Exposure

10 pkgs affected
🐘typo3/cms-core🐘typo3/cms-core🐘typo3/cms-core🐘typo3/cms-core🐘typo3/cms-core🐘typo3/cms🐘typo3/cms🐘typo3/cms+2 more

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Meta

  • CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC (5.7)

Problem

Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser do not consider all potentially malicious HTML tag & attribute combinations per default.

In addition, the lack of comprehensive default node configuration for rich-text fields in the backend user interface fosters this malfunction.

In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required.

Solution

Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described above.

Custom package typo3/html-sanitizer - based on allow-lists only - takes care of sanitizing potentially malicious markup. The default behavior is based on safe and commonly used markup - however, this can be extended or restricted further in case it is necessary for individual scenarios.

During the frontend rendering process, sanitization is applied to the default TypoScript path lib.parseFunc, which is implicitly used by the Fluid view-helper instruction f:format.html. Rich-text data persisted using the backend user interface is sanitized as well. Implementation details are explained in corresponding ChangeLog documentation.

Credits

Thanks to Benjamin Stiber, Gert-Jan Jansma, Gábor Ács-Kurucz, Alexander Kellner, Richie Lee, Nina Rösch who reported this issue, and to TYPO3 security team member Oliver Hader, as well as TYPO3 contributor Susanne Moog who fixed the issue.

References

Affected Packages

10 total 10 fixed
EcosystemPackageVulnerable rangeFix
🐘Packagisttypo3/cms-core≥ 7.0.0&&< 7.6.537.6.53composer require typo3/cms-core:^7.6.53
🐘Packagisttypo3/cms-core≥ 8.0.0&&< 8.7.428.7.42composer require typo3/cms-core:^8.7.42
🐘Packagisttypo3/cms-core≥ 10.0.0&&< 10.4.1910.4.19composer require typo3/cms-core:^10.4.19
🐘Packagisttypo3/cms-core≥ 11.0.0&&< 11.3.211.3.2composer require typo3/cms-core:^11.3.2
🐘Packagisttypo3/cms-core≥ 9.0.0&&< 9.5.299.5.29composer require typo3/cms-core:^9.5.29
🐘Packagisttypo3/cms≥ 10.0.0&&< 10.4.1910.4.19composer require typo3/cms:^10.4.19

Affected Products

1 product · 5 configurations
Application
typo3typo3
≥ 11.0.0 && ≤ 11.3.1
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for typo3/cms-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update typo3/cms-core to 7.6.53 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-32768 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

> ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality _[HTMLparser](https://docs.typo3.org/m/typo3/reference-typoscript/10.4/en-us/Functions/Htmlparser.html)_ do not consider all potentially malicious HTML tag & attribute combinations per default. In addition, the lack of comprehensive default node configuration for r
O3 Security · Impact-Aware SCA

Is CVE-2021-32768 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2021-32768: cms-core XSS — Fixed in 7.6.53