CVE-2025-71165 Typesetter CVE debrief

Who should care

Administrators and users of Typesetter CMS versions up to and including 5.1 should be aware of this vulnerability and take necessary actions to mitigate it. This includes updating Typesetter CMS to a version beyond 5.1, implementing proper output encoding for user-supplied input, restricting access to the administrative interface, and monitoring for suspicious activity.

Technical summary

The vulnerability is caused by the lack of proper output encoding of the path parameter in include/admin/Tools/Status.php. An authenticated attacker can exploit this vulnerability by supplying crafted input containing HTML or JavaScript, leading to arbitrary script execution in the context of an authenticated user's browser session. This issue affects Typesetter CMS versions up to and including 5.1.

Defensive priority

Medium

Recommended defensive actions

• Update Typesetter CMS to a version beyond 5.1
• Implement proper output encoding for user-supplied input
• Restrict access to the administrative interface
• Monitor for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-01-14T19:16:47.157Z and last modified on 2026-07-14T23:17:28.010Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Typesetter CMS versions up to and including 5.1. The path parameter in include/admin/Tools/Status.php is reflected into the HTML response without proper output encoding, allowing an authenticated attacker to supply crafted input containing HTML or JavaScript.

Official resources