TYPO3
589 CVEs across 117 TYPO3 products. Browse TYPO3 vulnerabilities, severities, and proof-of-concept exploits.
TYPO3 products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-50462 | Medium | 5.3 | 2026-09-14 | An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element… |
CVE-2023-50461 | High | 8.8 | 2026-09-14 | An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an aut… |
CVE-2023-50460 | Medium | 5.4 | 2026-09-14 | An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actio… |
CVE-2023-50459 | Medium | 5.4 | 2026-09-14 | An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticat… |
CVE-2023-45023 | Medium | 4.2 | 2026-09-14 | The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component. |
CVE-2026-85400 | | 2026-09-08 | Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show comm… | |
CVE-2026-77132 | | 2026-09-08 | It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, lo… | |
CVE-2026-77146 | | 2026-08-25 | The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), all… | |
CVE-2026-77145 | | 2026-08-25 | The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event… | |
CVE-2026-77144 | | 2026-08-25 | The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its ow… | |
CVE-2026-77143 | | 2026-08-25 | The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows… | |
CVE-2026-77142 | | 2026-08-25 | The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own… | |
CVE-2026-77141 | | 2026-08-25 | The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no owner… | |
CVE-2026-77140 | | 2026-08-25 | The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An… | |
CVE-2026-77139 | | 2026-08-25 | The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An auth… | |
CVE-2026-77138 | | 2026-08-25 | The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attack… | |
CVE-2026-77137 | | 2026-08-25 | The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL th… | |
CVE-2026-77136 | | 2026-08-25 | The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, wi… | |
CVE-2026-77135 | | 2026-08-25 | The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to t… | |
CVE-2026-77134 | | 2026-08-25 | The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainabl… | |
CVE-2026-77133 | | 2026-08-25 | The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field… | |
CVE-2026-77131 | | 2026-08-25 | When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the at… | |
CVE-2026-77128 | | 2026-08-25 | The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter t… | |
CVE-2026-77127 | | 2026-08-25 | The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privil… | |
CVE-2026-56096 | | 2026-08-25 | The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors… | |
CVE-2026-56095 | | 2026-08-25 | The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data f… | |
CVE-2026-56094 | | 2026-08-25 | The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and… | |
CVE-2026-56093 | | 2026-08-25 | The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular searc… | |
CVE-2026-56092 | | 2026-08-25 | The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persist… | |
CVE-2026-19418 | | 2026-08-11 | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend… | |
CVE-2026-15305 | | 2026-07-14 | Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction w… | |
CVE-2026-49742 | | 2026-06-09 | Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Si… | |
CVE-2026-49741 | | 2026-06-09 | Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler… | |
CVE-2026-49740 | | 2026-06-09 | TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restriction… | |
CVE-2026-49738 | | 2026-06-09 | The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, cau… | |
CVE-2026-47352 | | 2026-06-09 | Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outsi… | |
CVE-2026-47351 | | 2026-06-09 | Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather inf… | |
CVE-2026-47350 | | 2026-06-09 | Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13… | |
CVE-2026-47349 | | 2026-06-09 | Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issu… | |
CVE-2026-47348 | | 2026-06-09 | Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization… | |
CVE-2026-47347 | | 2026-06-09 | Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed… | |
CVE-2026-47346 | | 2026-06-09 | Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework'… | |
CVE-2026-47343 | | 2026-06-09 | Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active… | |
CVE-2026-11607 | | 2026-06-09 | Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the i… | |
CVE-2026-47344 | | 2026-06-08 | When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as val… | |
CVE-2026-8827 | | 2026-05-19 | The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not inv… | |
CVE-2026-8727 | | 2026-05-19 | The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint… | |
CVE-2026-8726 | | 2026-05-19 | The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL thro… | |
CVE-2026-46725 | | 2026-05-19 | The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can… | |
CVE-2026-46724 | | 2026-05-19 | The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbit… | |
CVE-2026-46723 | | 2026-05-19 | The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer… | |
CVE-2026-46722 | | 2026-05-19 | The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause loc… | |
CVE-2026-46721 | | 2026-05-19 | The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a… | |
CVE-2026-6553 | High | 7.5 | 2026-04-21 | Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users dat… |
CVE-2026-4208 | High | 8.8 | 2026-03-17 | The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by… |
CVE-2026-4202 | Medium | 4.3 | 2026-03-17 | The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page. |
CVE-2026-1323 | High | 8.8 | 2026-03-17 | The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted se… |
CVE-2026-0895 | | 2026-01-20 | The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/… | |
CVE-2026-0859 | High | 7.8 | 2026-01-13 | TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the m… |
CVE-2025-59022 | High | 8.1 | 2026-01-13 | Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had per… |
CVE-2025-59021 | Medium | 6.4 | 2026-01-13 | Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record with… |
CVE-2025-59020 | Medium | 6.5 | 2026-01-13 | By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability t… |
CVE-2025-12998 | | 2025-11-12 | Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5… | |
CVE-2025-10316 | | 2025-09-16 | The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from… | |
CVE-2025-59019 | Medium | 4.3 | 2025-09-09 | Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclo… |
CVE-2025-59018 | Medium | 6.5 | 2025-09-09 | Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 all… |
CVE-2025-59017 | High | 8.8 | 2025-09-09 | Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allo… |
CVE-2025-59016 | Medium | 4.3 | 2025-09-09 | Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.3… |
CVE-2025-59015 | Medium | 6.5 | 2025-09-09 | A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing a… |
CVE-2025-59014 | Low | 2.7 | 2025-09-09 | An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users t… |
CVE-2025-59013 | Medium | 6.1 | 2025-09-09 | An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.1… |
CVE-2025-9573 | | 2025-09-02 | The ns_backup extension through 13.0.2 for TYPO3 allows command injection. | |
CVE-2025-7900 | Medium | 6.5 | 2025-07-22 | The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager vers… |
CVE-2025-7899 | | 2025-07-22 | The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects power… | |
CVE-2025-48207 | High | 8.6 | 2025-05-21 | The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48206 | Medium | 6.1 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 allows XSS. |
CVE-2025-48205 | High | 8.6 | 2025-05-21 | The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48204 | Medium | 6.8 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 allows command injection. |
CVE-2025-48203 | Medium | 6.4 | 2025-05-21 | The cs_seo extension through 9.2.0 for TYPO3 allows XSS. |
CVE-2025-48202 | Medium | 5.3 | 2025-05-21 | The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference. |
CVE-2025-48201 | High | 8.6 | 2025-05-21 | The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. |
CVE-2025-48200 | Critical | 10.0 | 2025-05-21 | The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. |
CVE-2025-47941 | High | 7.2 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS… |
CVE-2025-47940 | High | 7.2 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. Starting in version 10.0.0 and prior to versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and… |
CVE-2025-47939 | Medium | 5.4 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allo… |
CVE-2025-47938 | Low | 3.8 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4… |
CVE-2025-47937 | Low | 3.7 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4… |
CVE-2025-47936 | Low | 3.3 | 2025-05-20 | TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS… |
CVE-2025-24856 | Medium | 4.2 | 2025-03-16 | An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. The account linking logic allows a pre-hijacking atta… |
CVE-2024-55945 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55924 | High | 8.0 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55923 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55922 | Medium | 5.4 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55921 | High | 7.5 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55920 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55894 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55893 | Medium | 4.3 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep li… |
CVE-2024-55892 | Medium | 4.8 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via a qu… |
CVE-2024-55891 | Low | 3.1 | 2025-01-14 | TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the pa… |
CVE-2024-34537 | Medium | 4.9 | 2024-10-28 | TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user accoun… |