What is GHSA-22q7-cg4r-p9mx?

GHSA-22q7-cg4r-p9mx is a security advisory published by GitHub Security Advisories with Medium severity. TYPO3 Cross-Site Scripting in Fluid ViewHelpers

Why does GHSA-22q7-cg4r-p9mx have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-22q7-cg4r-p9mx?

GHSA-22q7-cg4r-p9mx has a CVSS v3 base score of 6.1, published by GitHub Security Advisories.

Which products are affected by GHSA-22q7-cg4r-p9mx?

GHSA-22q7-cg4r-p9mx affects 2 products, including: composer/typo3/cms-fluid:\u003e= 8.0.0, \u003c 8.7.23; composer/typo3/cms-fluid:\u003e= 9.0.0, \u003c 9.5.4.

GHSA-22q7-cg4r-p9mxMediumCVSS 6.1Disclosed before NVD

TYPO3 Cross-Site Scripting in Fluid ViewHelpers

Vendor

GitHub Security Advisories

Published

May 30, 2024

Last Modified

July 16, 2026

📋 Description

Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to cross-site scripting.

🎯 Affected products2

composer/typo3/cms-fluid:>= 8.0.0, < 8.7.23
composer/typo3/cms-fluid:>= 9.0.0, < 9.5.4

🔗 References (7)

https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-01-22-4.yaml
https://typo3.org/security/advisory/typo3-core-sa-2019-005
https://github.com/TYPO3-CMS/fluid/commit/1a65dcc4a8f17f61a8055c0fd46c324c44c9980d
https://github.com/TYPO3-CMS/fluid/commit/a40f468d1534a68cfce91ce2a8e2a1ff81db5cf5
https://github.com/TYPO3-CMS/fluid/compare/v8.7.22...v8.7.23
https://github.com/TYPO3-CMS/fluid/compare/v9.5.3...v9.5.4
https://github.com/advisories/GHSA-22q7-cg4r-p9mx