--- title: "TYPO3-PSA-2019-003: Cross-Site Scripting in Flash component (ELTS)" url: "https://news.typo3.com/security/advisory/typo3-psa-2019-003" description: It has been discovered, that TYPO3 CMS is vulnerable to cross-site scripting. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - Public Service Announcement --- # TYPO3-PSA-2019-003: Cross-Site Scripting in Flash component (ELTS) - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2019-003: Cross-Site Scripting in Flash component (ELTS) ================================================================== 22 January 2019 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered, that TYPO3 CMS is vulnerable to cross-site scripting. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy) - **Release Date:** January 22, 2019 (December 11, 2018 for ELTS) - **Vulnerability Type:** Cross-Site Scripting - **Affected Versions:** TYPO3 6.2.0 to 6.2.38 ELTS, TYPO3 7.0.0 to 7.1.0 - **Severity:** Medium - **Suggested CVSS v3.0:** [AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:F/RL:O/RC:C) - **CVE:** [CVE-2020-8091](https://nvd.nist.gov/vuln/detail/CVE-2020-8091) ### Problem Description It has been discovered, that the third party component websvg is vulnerable to cross-site scripting. A browser with Flash plugin installed is needed in order to exploit this vulnerability. ### Solution Update to [TYPO3 version 6.2.39 ELTS](https://typo3.com/products/extended-support/) which fixes the problem described and removes the according file at *typo3/contrib/websvg/svg.swf*. The previous long term support versions TYPO3 v7.6.x were not affected anymore. ### Credits Thanks to [Purplemet Security](https://www.purplemet.com/) for reporting this issue. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security-guidelines). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg) About the Author [Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy) [More posts by this author](https://news.typo3.com/article/author/zoe-legacy)