A stored Cross‑Site Scripting flaw exists in the file upload module of TypiCMS Core before version 16.1.7. The application accepts SVG files based on MIME type alone, but does not sanitise the file contents. An attacker can craft an SVG containing JavaScript and upload it. When another user—such as an administrator—views the SVG through the CMS, the script runs in that user’s browser, allowing the attacker to hijack the session and execute arbitrary actions with the victim’s credentials.

TypiCMS Core versions earlier than 16.1.7 are affected. The vulnerability is present in all releases of the TypiCMS multilingual content management system built on Laravel that still ship the unfixed file‑upload handler. The only fix is the patch released in version 16.1.7.

The CVSS score of 6.8 indicates a moderate‑to‑high risk, and the very low EPSS (<1%) suggests limited real‑world exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. The flaw requires an attacker to have permission to upload files; once an SVG is uploaded, any privileged user who subsequently opens or downloads the file will have their session compromised. The bug in SVG parsing that can trigger a 500 error is not relevant to the XSS exploit because a properly formed malicious SVG can include the required viewBox attribute or omit it safely.