CVE-2026-27621: TypiCMS is a multilingual content management system based on the Laravel framework

Q: How do I fix CVE-2026-27621?

typicms: upgrade to 16.1.7. Exact commands for each OS are on this page.

Q: Is CVE-2026-27621 being exploited?

CVE-2026-27621 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-27621 affect?

CVE-2026-27621 affects typicms. Severity is medium (CVSS 5.4). TypiCMS is a multilingual content management system based on the Laravel framework. A Stored Cross-Site Scripting (XSS) vulnerability exists in the file upload module of TypiCMS prior to version 16.1.7. The application allows users with fil

Q: How urgent is CVE-2026-27621?

Priority 27/100. Public exploit reference

Routine

MEDIUM 5.4UPGRADE

CVE-2026-27621 is a medium-severity flaw (CVSS 5.4) affecting typicms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

TypiCMS is a multilingual content management system based on the Laravel framework. A Stored Cross-Site Scripting (XSS) vulnerability exists in the file upload module of TypiCMS prior to version 16.1.7. The application allows users with file upload permissions to upload SVG files. While there is a MIME type validation, the content of the SVG file is not sanitized. An attacker can upload a specially crafted SVG file containing malicious JavaScript

Why this priority

Public exploit reference

A fixed release or distro patch exists.

Risk facts

CVSS score	5.4 (Medium)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	Required
EPSS exploit chance	0.2% (top 87%)
CISA exploited list	No
Weakness	CWE-79
Published	2026-02-25
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: typicms

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-02-25 03:16 UTCPublished CVE record published
2026-06-17 10:27 UTCUpdated Record last modified

typicms typicms UPGRADE

Affected: < 16.1.7

Fixed in: 16.1.7

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy typicms || rpm -q typicms || typicms --version

2. UPGRADE to 16.1.7 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade typicms

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade typicms

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-27621?

typicms: upgrade to 16.1.7. Exact commands for each OS are on this page.

Is CVE-2026-27621 being exploited?

CVE-2026-27621 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-27621 affect?

CVE-2026-27621 affects typicms. Severity is medium (CVSS 5.4). TypiCMS is a multilingual content management system based on the Laravel framework. A Stored Cross-Site Scripting (XSS) vulnerability exists in the file upload module of TypiCMS prior to version 16.1.7. The application allows users with fil

How urgent is CVE-2026-27621?

Priority 27/100. Public exploit reference

Software pages

Laravel vulnerabilities

References

← Back to latest CVEs