--- title: "TYPO3-CORE-SA-2019-022: Cross-Site Scripting in Link Handling" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2019-022" description: It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting in Link Handling. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - TYPO3 CMS --- # TYPO3-CORE-SA-2019-022: Cross-Site Scripting in Link Handling - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2019-022: Cross-Site Scripting in Link Handling ============================================================= 17 December 2019 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting in Link Handling. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/959dc9d08a56cfd6673539bd9f05668f.jpeg)[Frank Nägler](https://news.typo3.com/article/author/frank-naegler) - **Component Type:** TYPO3 CMS - **Subcomponent:** Link Handling (ext:core, ext:frontend) - **Release Date:** December 17, 2019 - **Vulnerability Type:** Cross-Site Scripting - **Affected Versions:** 8.0.0-8.7.29 and 9.0.0-9.5.11 and 10.0.0-10.2.0 - **Severity:** Medium - **Suggested CVSS v3.1:** [AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C&version=3.1) - **CVE:** not assigned yet ### Problem Description It has been discovered that *t3://* URL handling and *typolink* functionality are vulnerable to cross-site scripting. Not only regular backend forms are affected but also frontend extensions which use the rendering with typolink. ### Solution Update to TYPO3 versions 8.7.30 or 9.5.12 or 10.2.2 that fix the problem described. ### Credits Thanks to Oliver Hader who reported this issue and to TYPO3 framework mergers Susanne Moog, Oliver Hader and Frank Nägler who analyzed and fixed the issue. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ### General Note All security related code changes are tagged so that you can easily look them up in our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/ff0e021ae96ab661b7b17352d9700a91.jpeg) About the Author [Frank Nägler](https://news.typo3.com/article/author/frank-naegler) CTO @ TYPO3 GmbH,Hamburg, Germany [Website](https://typo3.com)[LinkedIn](https://www.linkedin.com/in/franknaegler/)[Xing](https://www.xing.com/profile/Frank_Naegler) Frank loves solving hard problems with code, enjoys building cool stuff, and works as CTO for TYPO3 GmbH. He's been developing the TYPO3 CMS core since October 2014 and programming professionally since 2000. When he first started with TYPO3, version 3.6 was still in place. In his spare time, he enjoys playing golf and flying drones and has been an active member of the German Red Cross (GRC) for over 30 years. Frank regularly writes about TYPO3, PHP, Open Source Governance, and AI. [More posts by this author](https://news.typo3.com/article/author/frank-naegler)