Typemill vulnerabilities
CVEs whose affected-version data names the Typemill package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-120218Low· 3.5PoCTypemill SvgSanitizer.php saveImage cross site scripting
A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing a manipulation can lead to cross site scripting. The attack…
▾ TwilightEPSS 0.25%via CVEORG
CVE-2026-71518High· 7.5PoCTypemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants
Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute …
▾ Midnighttypemill · typemillEPSS 0.51%via NVD