Typemill vulnerabilities
We track 3 vulnerabilities in Typemill products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 17, 2026.
Latest Typemill vulnerabilities
- 7.5 High severity
typemill: Incorrect Authorization
Typemill before 2.26.0 contains an authorization bypass vulnerability in the media file download route that allows unauthenticated attackers to access restricted files by submitting path-equivalent URL variants. Attackers can substitute normalized path forms s
- 9.1 Critical severity
typemill: Improper Restriction of Excessive Authentication Attempts
Typemill's login endpoint (POST /tm/login, ControllerWebAuth::login) performs no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled, which is the default configuration. An unauthenticated attacker can send unlimited password-gu
- 8.8 High severity
Typemill: Unrestricted Upload of File with Dangerous Type
Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.