--- title: "TYPO3-CORE-SA-2015-004: Cross-Site Scripting in Link Handling & File List" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2015-004" description: It has been discovered, that TYPO3 is vulnerable to Cross-Site Scripting. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Product Updates & Roadmap" - TYPO3 CMS --- # TYPO3-CORE-SA-2015-004: Cross-Site Scripting in Link Handling & File List - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2015-004: Cross-Site Scripting in Link Handling & File List ============================================================================= 01 July 2015 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered, that TYPO3 is vulnerable to Cross-Site Scripting. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7569d41262328e5ed8d27b53e03970ec.png)[Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) **Component Type:** TYPO3 CMS **Release Date:** July 1, 2015 **Vulnerable subcomponent:** Link Handling (ext:frontend), Filelist Module (ext:filelist, ext:core) **Vulnerability Type:** Cross-Site Scripting **Affected Versions:** Versions 6.2.0 to 6.2.13, 7.0.0 to 7.3.0 **Severity:** Medium **Suggested CVSS v2.0:** [AV:N/AC:M/Au:S/C:P/I:P/A:N/E:F/RL:OF/RC:C](http://nvd.nist.gov/cvss.cfm?version=2&vector=(AV:N/AC:M/Au:S/C:P/I:P/A:N/E:F/RL:OF/RC:C)) **CVE:** not assigned yet **Problem Description:** It has been discovered that link tags generated by *typolink* functionality in the website's frontend are vulnerable to cross-site scripting - values being assigned to HTML attributes have not been parsed correctly. A valid backend user account is needed to exploit this vulnerability. As second and separate vulnerability in the filelist module of the backend user interface has been referenced with this advisory as well. Error messages being shown after using a malicious name for renaming a file are not propery encoded, thus vulnerable to cross-site scripting. A valid backend user account is needed to exploit this vulnerability. **Solution:** Update to TYPO3 versions 6.2.14 or 7.3.1 that fix the problem described. **Credits:** Thanks to Marc Bastian Heinrichs who discovered and reported the issue. **General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Opens external link in new window"). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. **General Note:** All security related code changes are tagged so that you can easily look them up on our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). --- **Document Updates:** - 2020-10-06 by Oliver Hader: changed vulnerable componet from "backend" to "frontend", adjusted severity from "low" to "medium", refined problem description ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bb9efc51bced8582e7b8c235f4b5f2b5.png) About the Author [Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) [More posts by this author](https://news.typo3.com/article/author/helmut-hummel)