Typemill Typemill
7 CVEs affecting Typemill Typemill. Latest disclosed: 2026-08-21. Critical: 1, High: 2.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-71213 | Critical | 9.1 | 2026-08-05 | Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is dis… |
CVE-2022-28053 | High | 8.8 | 2022-04-25 | Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. This vulnerability allows attackers to execute arbitr… |
CVE-2026-71518 | High | 7.5 | 2026-08-17 | Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restrict… |
CVE-2026-49133 | Medium | 6.5 | 2026-06-17 | Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside… |
CVE-2026-24127 | Medium | 5.4 | 2026-01-23 | Typemill is a flat-file, Markdown-based CMS designed for informational documentation websites. A reflected Cross-Site Scripting (XSS) exists in the login error… |
CVE-2026-44401 | Medium | 4.8 | 2026-08-10 | Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-c… |
CVE-2026-53468 | Medium | 4.6 | 2026-08-21 | Typemill is a flat-file, Markdown-based content management system designed for informational documentation websites. Versions prior to 2.23.0 are vulnerable to… |