CVE-2018-6905: The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename...

Security readout for executives and security teams

CVE-2018-6905 is a TYPO3 backend cross-site scripting issue tied to the configured site name. The cited description says an admin could enter a crafted site name during installation, which later affects the page module. Business risk is mainly for TYPO3 sites running older affected versions where backend users may view that module. Exposure appears limited to TYPO3 installations older than 8.7.11 or exactly before the 9.1.0 fix, especially where the site name could contain untrusted or poorly reviewed content. The bundle indicates an admin-entered installation value, so internet-wide unauthenticated exposure is not supported by the provided sources. Treat this as a targeted CMS hygiene issue, not an emergency based on the provided evidence. Prioritize remediation where legacy TYPO3 backends remain in use, especially production systems with multiple administrators or weak change control. Mitigation focus: Upgrade TYPO3 to 8.7.11, 9.1.0, or a later supported release.; Review vendor guidance linked from the TYPO3 issue before applying production changes.; Inspect TYPO3 site name configuration for unexpected markup or script-like content..

Prepared

Jun 7, 2026, 14:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.