CVE-2026-27621

CVE-2026-27621 affects TypiCMS Core prior to 16.1.7. A Stored XSS exists in the file upload module: SVG files can bypass sanitization despite MIME type validation, allowing an attacker with upload privileges to inject malicious JavaScript. When an admin or authenticated user views the uploaded SV...