# CVE-2024-34356: cms-core XSS — Fixed in 9.5.48 🐘 🐘 Packagist Not in CISA KEV MEDIUM severity # CVE-2024-34356 — cms-core MEDIUM [Fix: TYPO3/typo3@2832e2f](https://github.com/TYPO3/typo3/commit/2832e2f51f929aeddb5de7d667538a33ceda8156) CVE-2024-34356 is a medium-severity (CVSS 5.4) Cross-site Scripting (XSS) vulnerability in typo3/cms-core. A fix is available for typo3/cms-core — see the affected versions and patch details below. TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module Also known as[GHSA-v6mw-h7w6-59w3](/vulnerability/GHSA-v6mw-h7w6-59w3) Published May 14, 2024 Updated Oct 28, 2026 Affected 5 pkgs Patched 5 / 5 Exploits None indexed Exploitation data as of Nov 4, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2024-34356. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.5%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs43th percentile — riskier than 43% of all scored CVEsHighest risk 0.00%0.38%0.76%1.13%0.6%0.5%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 5 pkgs affected 🐘`typo3/cms-core`🐘`typo3/cms-core`🐘`typo3/cms-core`🐘`typo3/cms-core`🐘`typo3/cms-core` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description #### Problem The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. #### Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described. #### Credits Thanks to TYPO3 core & security team member Benjamin Franzke who reported and fixed the issue. #### References - [TYPO3-CORE-SA-2024-008](https://typo3.org/security/advisory/typo3-core-sa-2024-008) ## Affected Packages 5 total 5 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `typo3/cms-core` ≥ 9.0.0&&< 9.5.48 9.5.48`composer require typo3/cms-core:^9.5.48` 🐘Packagist `typo3/cms-core` ≥ 10.0.0&&< 10.4.45 10.4.45`composer require typo3/cms-core:^10.4.45` 🐘Packagist `typo3/cms-core` ≥ 11.0.0&&< 11.5.37 11.5.37`composer require typo3/cms-core:^11.5.37` 🐘Packagist `typo3/cms-core` ≥ 12.0.0&&< 12.4.15 12.4.15`composer require typo3/cms-core:^12.4.15` 🐘Packagist `typo3/cms-core` ≥ 13.0.0&&< 13.1.1 13.1.1`composer require typo3/cms-core:^13.1.1` ## Affected Products 1 product · 5 configurations Application `typo3`typo3 ≥ 13.0.0 && < 13.1.1 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for typo3/cms-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update typo3/cms-core to 9.5.48 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-34356 is resolved across your whole dependency graph. 3. ### Workarounds Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page. ## Frequently Asked Questions \### Problem The form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. ### Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described. ### Credits Thanks to TYPO3 core & security team member Benjamin Franzke who reported and fixed the issue. ### References \* \[TYPO3-CORE-SA-2024-008\](https://typo3.org/security/advisory/typo3-core-sa-2024-008) O3 Security · Impact-Aware SCA ### Is CVE-2024-34356 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)