Is CVE-2020-26216 actively exploited?

No active exploitation of CVE-2020-26216 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2020-26216 be exploited remotely?

Yes. CVE-2020-26216 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2020-26216?

CVE-2020-26216 has a CVSS score of 6.1 (MEDIUM).

HOME VULNERABILITIESCVE-2020-26216

MEDIUM

CVE-2020-26216

CWE-79Published: November 17, 2020· Updated: Jun 17, 2026

6.1

CVSS v3.1

Official Description

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with attribute-closing quotes followed by HTML. When rendering such attributes, TagBuilder would not escape the keys. 2. ViewHelpers which used the CompileWithContentArgumentAndRenderStatic trait, and which declared escapeOutput = false, would receive the content argument in unescaped format. 3. Subclasses of AbstractConditionViewHelper would receive the then and else arguments in unescaped format. Update to versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 or 2.6.10 of this typo3fluid/fluid package that fix the problem described. More details are available in the linked advisory.

NVD Source

Technical Analysis

CVE-2020-26216 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

From a weakness classification perspective (CWE-79): Cross-site scripting (XSS) vulnerabilities allow attackers to inject malicious scripts into web pages viewed by other users.