PT-2026-47448

CVE-2026-47344

Published

2026-06-08

Updated

2026-07-23

Description by

CVSS 4.0

2.1

Low

MetricsAV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions typo3/html-sanitizer versions prior to 2.3.2

Description When the ALLOW INSECURE RAW TEXT setting is enabled, the sanitizer fails to recognize closing tags containing whitespace variants, such as </stylet>. Because browsers interpret these as valid end tags, subsequent content can escape the sanitization process, enabling a bypass of the cross-site scripting prevention mechanism.

Recommendations Update to version 2.3.2 or later. As a temporary mitigation, disable the ALLOW INSECURE RAW TEXT setting.

Exploitability

Exploit

Fix

Impacts

Researchers

Ipc Labs

Oliver Hader

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')