CVE-2026-44401

Name of the Vulnerable Software and Affected Versions Typemill CMS versions 2.x

Description A persistent cross-site scripting issue exists in the Markdown parser extension. Authenticated users with theme-configuration access can inject malicious JavaScript URIs by providing unsanitized href values in Markdown links. This is possible through ParsedownExtension.php or TwigMarkdownExtension.php by using the javascript: scheme. The stored payload executes in the browser of any visitor who clicks the link, which can lead to session cookie theft, authenticated request forgery, and credential harvesting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.