CVE-2020-8091: TYPO3

Medium severity, CVSS 6.1. EPSS: 5.2% chance of exploitation in the next 30 days.

svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system. This may be at a contrib/websvg/svg.swf pathname.

Affected products

• TYPO3 TYPO3: from 6.2, before 6.2.39 (fixed in 6.2.39); from 7.0.0, up to and including 7.1.0

Published 2020-01-27. Last modified 2026-06-17.