CVE-2026-120218

    Dashboard / Vulnerabilities / CVE-2026-120218

    CVE-2026-120218

    Published: 1 Nov 2026Last Modified: 8 Nov 2026

    Summary: Typemill SvgSanitizer.php saveImage cross site scripting

    Details: A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version 2.27.0 is sufficient to resolve this issue. This patch is called 9ca43c4a7b6764c5a6ac11a2ccc099b036ee3cef. It is recommended to upgrade the affected component.

    References: https://github.com/typemill/typemill/, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/120xxx/CVE-2026-120218.json, https://nvd.nist.gov/vuln/detail/CVE-2026-120218, https://vuldb.com/cve/CVE-2026-120218, https://vuldb.com/submit/992817, https://vuldb.com/vuln/429569, https://vuldb.com/vuln/429569/cti, https://github.com/typemill/typemill/commit/9ca43c4a7b6764c5a6ac11a2ccc099b036ee3cef, https://github.com/typemill/typemill/releases/tag/v2.27.0

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- a8ab719b1bd576b604d0f1a230f10a5b48850b70
    Fixed -9ca43c4a7b6764c5a6ac11a2ccc099b036ee3cef

    Affected versions

    2.15
    2.15.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-120218 | CVE-DB