--- title: "TYPO3-PSA-2020-003: Mitigation of Cross-Site Scripting Vulnerabilities in File Upload Handling" url: "https://news.typo3.com/security/advisory/typo3-psa-2020-003" description: Repeating and refining public service announcement TYPO3-PSA-2019-010. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - "Product Updates & Roadmap" - Public Service Announcement --- # TYPO3-PSA-2020-003: Mitigation of Cross-Site Scripting Vulnerabilities in File Upload Handling - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2020-003: Mitigation of Cross-Site Scripting Vulnerabilities in File Upload Handling ============================================================================================== 17 November 2020 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) Repeating and refining public service announcement TYPO3-PSA-2019-010. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b8266fdc667b773926c59081862ab148.jpeg)[Oliver Hader](https://news.typo3.com/article/author/oliver-hader) --- - **Component Type:** TYPO3 CMS - **Subcomponent:** File Upload Handling (ext:filelist) - **Release Date:** November 17, 2020 - **Affected Versions:** all --- ### Problem Description According to [TYPO3-PSA-2019-010](https://typo3.org/security/advisory/typo3-psa-2019-010) authenticated users - but not having administrator privileges - are allowed to upload files to their granted file mounts (e.g. *fileadmin/* in most cases). This also includes the possibility to upload potential malicious code in *HTML* or *SVG* files (using JavaScript, injecting cross-site scripting vulnerabilities). Custom applications might allow uploading SVG files among other image file formats in user profile avatars - just to give another example of a potential attack vector. Per definition, this allows attackers to introduce cross-site scripting vulnerabilities. This announcement is repeating [TYPO3-PSA-2019-010](https://typo3.org/security/advisory/typo3-psa-2019-010). ### Solution To mitigate these potential scenarios it is advised to deny uploading files as described in [TYPO3-PSA-2019-010](https://typo3.org/security/advisory/typo3-psa-2019-010) - which might be impractical for some sites. Alternative mitigation strategies are explained below. ### Mitigation TYPO3 versions 9.5.23 and 10.4.10 are shipped with a new security check verifying basic Content Security Policy headers (see below) for resources in fileadmin/. Since TYPO3 allows to create and compose custom applications the following mitigation strategies should be considered individually on websites in production. #### Content Security Policy HTTP header [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) is an added layer of security that helps to detect and mitigate certain types of attacks, including Cross-Site Scripting (XSS) and data injection attacks. These attacks are used for everything from data theft to site defacement to the distribution of malware. It is advised to add content security policy headers for public accessible directories - basically all base directories of file storages (*sys\_file\_storage*). The following example shows the contents of a file to be located at *fileadmin/.htaccess* when using Apache 2.x web servers - it has to be duplicated for any other custom file storage location. ```   Header set Content-Security-Policy "default-src 'self' 'unsafe-inline'; script-src 'none'; object-src 'self'; plugin-types application/pdf;"       Header set Content-Security-Policy "default-src 'self'; script-src 'none'; style-src 'none'; object-src 'none';"   ``` This way scripts in *HTML* or *SVG* files are not executed anymore in modern browsers that support Content Security Policies. **Update December 10th, 2020** CSP rules have been updated, allowing to show PDF documents in Safari browsers again. #### svg-sanitizer extension To sanitize (and remove malicious cross-site scripting code) from user-submitted *SVG* files, it is suggested to make use of 3rd party extension *svg\_sanitizer* (composer package *t3g/svg-sanitizer*). - - This way SVG contents that are embedded in application markup (inline SVG) cannot execute scripts anymore. ### Credits Thanks to Sinan Sekerci (Dreamlab Technologies) who brought this topic again to our attention. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security-guidelines). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/cc7cba9757f98fbe05023a139119df74.jpeg) About the Author [Oliver Hader](https://news.typo3.com/article/author/oliver-hader) Core Developer at TYPO3 GmbH,Hof, Germany [Website](https://typo3.com)[Twitter](https://twitter.com/ohader)[LinkedIn](https://www.linkedin.com/in/oliverhader/)[Xing](https://www.xing.com/profile/Oliver_Hader) Oliver started to work with TYPO3 in 2005 and was fascinated by the product and its universe. Since 2007 he is member of the TYPO3 Core Team. After going back to university in 2014 for achieving a postgraduate master degree in internet web science, he is now researching on advanced web technology topics in general and for TYPO3 in particular. In his spare time, Oliver loves to go cycling cross-country in the uplands around Hof (Germany) in northern Bavaria - at the region where he's living as well. [More posts by this author](https://news.typo3.com/article/author/oliver-hader)