Typemill CMS < 2.23.0 - Cross-Site Scripting
CVE-2026-53468
Early Release
Description
Typemill CMS before version 2.23.0 is vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated meta tags via the /api/v1/meta endpoint due to missing output encoding in the renderMeta() function in system/typemill/Assets.php.
Severity
Medium
CVSS Score
4.6
Exploit Probability
0%
Affected Product
typemill
Published Date
October 25, 2026
Template Author
sandiyochristan
CVE-2026-53468.yaml
4.6Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVE ID:
cve-2026-53468
CWE ID:
cwe-79
Remediation Steps
Update Typemill CMS to version 2.23.0 or later, which applies htmlspecialchars() encoding to metadata values before rendering.