CVE-2026-44401: Typemill CMS 2.x Persistent XSS via Markdown javascript URI
Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdown links using the javascript: scheme through ParsedownExtension.php or TwigMarkdownExtension.php, storing a persistent payload that executes in the browser of every visitor who clicks the link, enabling session cookie theft, authenticated request forgery, and credential harvesting.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44401?
The severity of CVE-2026-44401 is rated as medium with a score of 4.8.
How do I fix CVE-2026-44401?
To fix CVE-2026-44401, update Typemill CMS to the latest version where the vulnerability is patched.
Who is affected by CVE-2026-44401?
CVE-2026-44401 affects authenticated users of Typemill CMS version 2.x with theme-configuration access.
What type of vulnerability is CVE-2026-44401?
CVE-2026-44401 is classified as a persistent cross-site scripting (XSS) vulnerability.
What can attackers do with CVE-2026-44401?
Attackers can exploit CVE-2026-44401 to inject malicious JavaScript URIs into Markdown links, compromising the application.