CVE-2021-36787 is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in in2code/femanager. 2 public exploit or proof-of-concept references are indexed, so weaponization risk is real. A fix is available for in2code/femanager — see the affected versions and patch details below.
Cross-site Scripting in the femanager TYPO3 extension
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
in2code/femanager🐘in2code/femanagerReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website.
Note: If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) to prevent upload of malicious SVG files or to set up a strict Content Security Policy for the destination folder of uploaded images.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | in2code/femanager | all versions | 5.5.1composer require in2code/femanager:^5.5.1 |
| 🐘Packagist | in2code/femanager | ≥ 6.0.0&&< 6.3.1 | 6.3.1composer require in2code/femanager:^6.3.1 |
Affected Products
femanagerin2codeResearch use only. For defensive security, authorized penetration testing, and academic research only. Never execute exploit code against systems without explicit written authorization.
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for in2code/femanager, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update in2code/femanager to 5.5.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2021-36787 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is CVE-2021-36787 in your dependencies?
Find it across Packagist, including transitive dependencies.