Skip to content
OpenAdvisories
Medium · 4.8 Public exploit CVE-2026-44401 EUVD-2026-55793GHSA-8vfw-vh7q-p649

Typemill CMS 2.x Persistent XSS via Markdown javascript URI

Published Aug 10, 2026 · Updated Nov 8, 2026 · Assigned by VulnCheck

Vendor: typemill Product: typemill

Description

Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdown links using the javascript: scheme through ParsedownExtension.php or TwigMarkdownExtension.php, storing a persistent payload that executes in the browser of every visitor who clicks the link, enabling session cookie theft, authenticated request forgery, and credential harvesting.

Affected products

VendorProductAffectedFixed
Typemill Typemill 2.0.0 – ≤ 2.23.0 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • sn0x-sharma/CVE-2026-44401 ★ 2 · Aug 11, 2026

    Persistent XSS in Typemill CMS: the Markdown parser lets javascript: URIs through unfiltered. Writeup + PoC.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References