CVE-2026-47348: TYPO3 CMS Stored XSS Vulnerability

CVE-2026-47348 Overview

CVE-2026-47348 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the TYPO3 CMS Indexed Search plugin. Editors with permission to create or modify page content can inject HTML markup into page titles. The Indexed Search component stores these titles in the search index without sanitization. When the frontend renders search results, the titles are output without proper HTML encoding, allowing script execution in visitors' browsers.

The issue affects TYPO3 CMS versions 13.0.0 through 13.4.30 and 14.0.0 through 14.3.2. Exploitation requires an authenticated backend editor account and user interaction with the rendered search results.

Critical Impact
Authenticated editors can persist arbitrary JavaScript into the frontend search index, executing scripts in the context of any site visitor who views a matching search result.

Affected Products

TYPO3 CMS versions 13.0.0 to 13.4.30
TYPO3 CMS versions 14.0.0 to 14.3.2
TYPO3 indexed_search system extension (frontend rendering)

Discovery Timeline

2026-06-09 - CVE-2026-47348 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-47348

Vulnerability Analysis

The vulnerability resides in the SearchController of the indexed_search system extension. The controller assembles result entries by concatenating item_title and titleaddition fields, then truncates the value with GeneralUtility::fixed_lgd_cs(). Prior to the fix, the resulting $title variable was passed directly into HTML output without encoding.

Because TYPO3 page titles accept content provided by editors, any HTML or JavaScript stored in the title field is persisted into the search index. When a site visitor performs a query that matches an affected page, the rendered search results inject the raw title into the page DOM, triggering script execution. The attack qualifies as stored XSS because the payload lives in the indexed dataset and replays on every matching query.

Root Cause

The root cause is missing output encoding in the frontend search results rendering path. Editor-supplied page titles were trusted as safe HTML even though TYPO3's editor role does not require the elevated privileges normally needed to author markup. The Indexed Search plugin assumed upstream sanitization that did not exist for the title field.

Attack Vector

An attacker with editor-level backend access creates or edits a page and embeds an HTML or JavaScript payload in the page title. After the page is crawled and indexed, any frontend visitor who performs a search query matching the malicious page receives a rendered result containing the executable payload. Exploitation requires low privileges and user interaction with the search interface.

php

         }
         $title = $resultData['item_title'] . ($resultData['titleaddition'] ?? '');
         $title = GeneralUtility::fixed_lgd_cs($title, (int)$this->settings['results.']['titleCropAfter'], $this->settings['results.']['titleCropSignifier']);
+        $title = htmlspecialchars($title);
         // If external media, link to the media-file instead.
         if ($row['item_type']) {
             if ($row['show_resume']) {
                 $targetAttribute = '';
                 if ($typoScriptConfigArray['fileTarget'] ?? false) {
                     $targetAttribute = ' target="' . htmlspecialchars($typoScriptConfigArray['fileTarget']) . '"';
                 }
-                $title = '<a href="' . htmlspecialchars($row['data_filename']) . '"' . $targetAttribute . '>' . htmlspecialchars($title) . '</a>';
+                $title = '<a href="' . htmlspecialchars($row['data_filename']) . '"' . $targetAttribute . '>' . $title . '</a>';
             } else {
                 // Suspicious, so linking to page instead...
                 $copiedRow = $row;

Source: TYPO3 Security Patch Commit. The fix calls htmlspecialchars() on the assembled $title after truncation, ensuring all output paths emit encoded content.

Detection Methods for CVE-2026-47348

Indicators of Compromise

Page records in the pages table containing <script>, onerror=, onload=, or other HTML event-handler markup inside the title or nav_title columns.
Entries in the index_phash or index_grlist tables where indexed title fields contain HTML tags or encoded script payloads.
Frontend search result responses returning HTML markup inside <h3> or anchor elements that originated from page titles.

Detection Strategies

Run database queries against the pages table searching for HTML metacharacters (<, >, ", ') embedded in title fields and review matches against editorial intent.
Audit TYPO3 backend change logs (sys_log, sys_history) for page title edits performed by editor accounts, correlating against unexpected payload patterns.
Inspect rendered search result pages from a non-authenticated session and confirm titles are HTML-encoded after applying the patch.

Monitoring Recommendations

Forward TYPO3 backend authentication and content modification events to a centralized logging pipeline for review of editor activity.
Alert on frontend HTTP responses from tx_indexedsearch_pi2 or equivalent search endpoints that contain <script substrings in result payloads.
Track editor accounts that modify large numbers of page titles in short windows, which can indicate automated payload seeding.

How to Mitigate CVE-2026-47348

Immediate Actions Required

Upgrade TYPO3 CMS to a patched release: 13.4.31 or later in the 13.x branch, or 14.3.3 or later in the 14.x branch.
Review existing page titles in the database for HTML or scripting content and sanitize any records inserted before patching.
Rebuild or purge the Indexed Search index after sanitizing source titles so cached entries no longer contain payloads.

Patch Information

TYPO3 issued the fix in the indexed_search extension by applying htmlspecialchars() to the assembled title before frontend rendering. The change is documented in commits 2e96dd0e and 8004b91a. Full details are available in the TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-010.

Workarounds

Temporarily disable the Indexed Search frontend plugin until the patched TYPO3 version is deployed.
Restrict editor backend permissions so only trusted users can modify page titles, and remove HTML-capable rich text fields from the title input.
Apply a custom Fluid view helper or TypoScript wrap that calls htmlspecialchars on item_title output as a stopgap rendering control.

bash

# Upgrade TYPO3 CMS using Composer to a patched release
composer require typo3/cms-core:"^13.4.31 || ^14.3.3" --update-with-dependencies

# Rebuild the Indexed Search index after upgrading
vendor/bin/typo3 indexedsearch:remove --all
vendor/bin/typo3 scheduler:run