TYPO3 HTML Sanitizer allows Cross-site Scripting

概要

参考情報

• TYPO3/html-sanitizer security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2026-47345 · ADVISORY
• TYPO3/html-sanitizer commit 8b5d0be · WEB
• FriendsOfPHP/security-advisories · WEB
• TYPO3/html-sanitizer · PACKAGE
• typo3.org/security/advisory/typo3-core-sa-2026-006 · WEB

typo3/html-sanitizer のその他の脆弱性

• CVE-2026-47344低 2.1When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted…
• CVE-2023-47125中 6.1TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions…
• CVE-2023-38500中 6.1TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed ta…
• CVE-2022-23499中 6.1HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions pri…
• CVE-2022-36020中 6.1The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, a…