Cross-Site Scripting in Frontend Login Mailer

Vulnerability

In TYPO3 CMS versions prior to 9.5.34 ELTS, 10.4.29, and 11.5.11, user-submitted content is incorporated into HTML-formatted emails without proper encoding. This allows malicious input to be interpreted as active HTML or JavaScript when the email is rendered in a mail client. The affected component is the mail template rendering logic that builds notification or confirmation emails using unescaped user data [1][2].

Exploitation

An attacker needs the ability to submit content that will later be included in an HTML email sent to another user (e.g., via a comment, form submission, or profile field). No special network position or authentication level is required beyond the privileges needed to provide that content. The attack is triggered when the victim reads the email using an HTML-capable mail client; no user interaction beyond opening the message is necessary [1].

Impact

Successful exploitation leads to cross-site scripting (XSS) within the context of the recipient's email client. The attacker may execute arbitrary JavaScript, steal session tokens, redirect to phishing pages, or perform other actions limited by the mail client's security model. The impact is primarily on the confidentiality and integrity of the victim's session and data [1].

Mitigation

TYPO3 CMS versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix that properly encodes user-submitted content before inclusion in HTML emails. All sites should upgrade to one of these patched releases immediately. No workarounds are documented; configuring mail clients to render emails as plain text can reduce risk but is not a complete mitigation [1][2].