CVE-2026-120218

A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publishe...

CVE-2026-120218 Typemill SvgSanitizer.php saveImage cross site scripting

A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publishe...

CVE-2026-120218

A stored cross-site scripting (XSS) vulnerability exists in TypeMill versions 2.6.0 through 2.26.0 within the SvgSanitizer component. The root cause is that the sanitizer uses DOMDocument::getElementsByTagName("*") to filter XML elements, which fails to detect and remove XML processing instructio...

EUVD-2026-114786

A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publishe...

CVE-2026-120218: n/a Typemill: A flaw has been found in Typemill up to 2.26.0

A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been publishe...