--- title: "TYPO3-CORE-SA-2016-021: Cross-Site Scripting in TYPO3 Backend" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2016-021" description: It has been discovered, that TYPO3 is vulnerable to Cross-Site Scripting image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Product Updates & Roadmap" - TYPO3 CMS --- # TYPO3-CORE-SA-2016-021: Cross-Site Scripting in TYPO3 Backend - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2016-021: Cross-Site Scripting in TYPO3 Backend ============================================================= 13 September 2016 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered, that TYPO3 is vulnerable to Cross-Site Scripting - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/60cadc25d9a14674c5c05025d6f818a4.jpeg)[Georg Ringer](https://news.typo3.com/article/author/georg-ringer) **Component Type:** TYPO3 CMS **Release Date:** September 13, 2016 **Vulnerability Type:** Cross-Site Scripting **Affected Versions:** 6.2.0 to 6.2.26, 7.6.0 to 7.6.10 and 8.0.0 to 8.3.0 **Severity:** Low **Suggested CVSS v2.0:** [AV:N/AC:L/Au:S/C:P/I:P/A:N/E:F/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:S/C:P/I:P/A:N/E:F/RL:O/RC:C%29&g=2&lang=en) **CVE:** not assigned yet **Problem Description:** Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability. **Solution:** Update to TYPO3 versions 6.2.27, 7.6.11 or 8.3.1 that fix the problem described. **Credits:** Thanks to Security Team Member Georg Ringer who discovered and reported the issue. **General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Opens external link in new window"). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. **General Note:** All security related code changes are tagged so that you can easily look them up on our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/99db18b2c6e92024e8936def3dc244e7.jpeg) About the Author [Georg Ringer](https://news.typo3.com/article/author/georg-ringer) TYPO3 developer,Linz, Austria [Website](http://montagmorgen.at/)[Twitter](https://twitter.com/georg_ringer)[LinkedIn](https://www.linkedin.com/in/georgringer/)[Xing](https://www.xing.com/profile/Georg_Ringer/cv) Georg Ringer has been part of the TYPO3 community more than 10 years and is known for the large number of extensions he has published. He is part of the TYPO3 Core and Security Teams and is also the GDPR Initiative Lead. [More posts by this author](https://news.typo3.com/article/author/georg-ringer)