TYPO3 Enterprise CMS

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any TYPO3 product.

RSS Feeds for TYPO3 security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in TYPO3 products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by TYPO3 Sorted by Most Security Vulnerabilities since 2018

TYPO3102 vulnerabilities

TYPO3 Html Sanitizer6 vulnerabilities

TYPO3 Pharstreamwrapper2 vulnerabilities

TYPO3 Fluid1 vulnerability

TYPO3 Fluid Engine1 vulnerability

TYPO3 Form To Database1 vulnerability

TYPO3 Mediace1 vulnerability

TYPO3 Modules1 vulnerability

TYPO3 Svg Sanitizer1 vulnerability

By the Year

In 2026 there have been 58 vulnerabilities in TYPO3 with an average score of 7.4 out of ten. Last year, in 2025 TYPO3 had 10 security vulnerabilities published. That is, 48 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	58	7.39
2025	10	0.00
2024	9	5.64
2023	7	5.60
2022	17	6.11
2021	16	6.37
2020	16	6.77
2019	8	9.03
2018	1	0.00

It may take a day or so for new TYPO3 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent TYPO3 Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-56092	Aug 25, 2026	TYPO3 CMS Extension Bypasses Subpage Access via Cached Rootline The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages.	TYPO3
CVE-2026-56093	Aug 25, 2026	TYPO3 solr Extension Frontend Detail-View Bypass: SiteHash & FE Filters Not Applied The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through this lookup without the same access restrictions enforced elsewhere.	TYPO3
CVE-2026-56094	Aug 25, 2026	TYPO3 Solr Ext: Unchecked Filter Injection Enables Site Hash Bypass The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serving multiple TYPO3 sites, a visitor can use this to read public documents belonging to another site. The same root cause also affects the suggest top-results path when suggest is enabled.	TYPO3
CVE-2026-56095	Aug 25, 2026	TYPO3 PHP Object Injection via Unserialize in Indexer The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a safe format. If user-generated content saved in the TYPO3 database can reach an indexed field, this exposes a PHP Object Injection surface.	TYPO3
CVE-2026-77127	Aug 25, 2026	TYPO3 Extension Backend AJAX Field Disclosure The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error response that discloses the current database value of the requested field, leading to disclosure of sensitive information such as backend and frontend user password hashes. Exploitation requires a valid, authenticated TYPO3 backend user account with access to the extensions backend module.
CVE-2026-56096	Aug 25, 2026	TYPO3 Extension: Unrestricted Solr Query Injection Enables Blind Data Extraction The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field names and extract their stored values through boolean- and range-based blind extraction techniques, independent of any site-specific configuration.	TYPO3
CVE-2026-77128	Aug 25, 2026	TYPO3 CMS: Unauthenticated Remote Access via Missing Enable-Field Enforcement The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires only that disableOverrideDemand is not enabled.
CVE-2026-77129	Aug 25, 2026	TYPO3 CMS Event Reg Ext. XSS via unchecked Fluid subject The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensitive data or execute TypoScript content objects. Exploitation of this issue requires an authenticated backend account with edit access to the event registration plugin or backend module.
CVE-2026-77131	Aug 25, 2026	TYPO3 CMS Extension Sends System Info in Cleartext Without OpenSSL When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.	TYPO3
CVE-2026-77130	Aug 25, 2026	TYPO3 SysSy JWT Expiration Validation Bypass The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project's API key.	TYPO3
CVE-2026-77133	Aug 25, 2026	TYPO3 CMS Extension SelfService Priv Escalation via FG Assignment (CVE-2026-77133) The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.
CVE-2026-77134	Aug 25, 2026	TYPO3 Ext: Admin Token Omitted Allows User Self-Approval via Confirmation Hash The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.
CVE-2026-77136	Aug 25, 2026	TYPO3 Powermail Fluid Template Injection (CVE-2026-77136) The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.
CVE-2026-77135	Aug 25, 2026	TYPO3 Ext User Detail View: Arbitrary User Data Disclosure The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.
CVE-2026-77137	Aug 25, 2026	TYPO3 Forms Export Extension SQLi via Unsanitized URL Param The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.
CVE-2026-77138	Aug 25, 2026	TYPO3 PHP Object Injection via Untrusted Cookie (RCE) The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.
CVE-2026-77139	Aug 25, 2026	TYPO3 Mask Extension Path Traversal via Template Key The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.
CVE-2026-77141	Aug 25, 2026	TYPO3 Extension: Unauth Club Record Overwrite via Missing Ownership Check The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.
CVE-2026-77140	Aug 25, 2026	TYPO3 Ext HMAC Bypass Allows Unauth Record Overwrite The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.
CVE-2026-77142	Aug 25, 2026	TYPO3 CMS: Missing Ownership Check Enables Company Record Overwrite The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.
CVE-2026-77143	Aug 25, 2026	TYPO3 Forum Topic Edit Ownership Checking Bypass The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership. Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration.
CVE-2026-77145	Aug 25, 2026	TYPO3 CMS: Frontend Event Management Permission Bypass Allows Tampering The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.
CVE-2026-77144	Aug 25, 2026	TYPO3 Frontend Event Plugin Enables Privilege Escalation Organizer Attribution The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.
CVE-2026-77146	Aug 25, 2026	TYPO3 8.x FE Invite Ext Unauth PW Reset The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.
CVE-2026-19418	Aug 11, 2026	TYPO3 CMS 13-14 Referrer Bypass Enables Backend Access via SameDomain JS The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.	TYPO3
CVE-2026-15305	Jul 14, 2026	TYPO3 CMS 14.2-14.3.5: Arbitrary MIME type upload Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.	TYPO3
CVE-2026-49742	Jun 09, 2026	TYPO3 CMS FAL Media Module file download flaw (v1114) Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-49741	Jun 09, 2026	TYPO3 CMS 14.014.3.3 FormFramework DataHandler Bypass Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.	TYPO3
CVE-2026-49740	Jun 09, 2026	TYPO3 CMS PHP Object Injection via VarFront/Reg deserialization (v<14) TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store or sys_registry database table) could inject a crafted serialized payload to trigger PHP Object Injection, potentially exploiting a gadget chain to achieve Remote Code Execution or other high-impact effects. Exploiting this vulnerability requires direct local write access to the storage, such as the SQL database or file system. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-49738	Jun 09, 2026	TYPO3 CMS Path Traversal in GeneralUtility::isAllowedAbsPath < 14.3.3 The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47352	Jun 09, 2026	TYPO3 CMS File Meta Disclosure via Backend API < 10.4.57 Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47351	Jun 09, 2026	TYPO3 CMS clipboard privilege escalation in v10.4-14.3 Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47350	Jun 09, 2026	TYPO3 CMS <=14.3.3 Auth Bypass: Move records w/o edit perms. Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47349	Jun 09, 2026	TYPO3 CMS Soft-Delete Restore Exploit in 10.4.57/11.5.51/12.4.46/13.4.31/14.3.3 Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47348	Jun 09, 2026	TYPO3 CMS 13-14 XSS via Unsanitized Page Titles in Indexed Search Plugin Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47347	Jun 09, 2026	TYPO3 CMS Open Redirect via GeneralUtility::sanitizeLocalUrl (v<10.4.57) Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47346	Jun 09, 2026	TYPO3 CMS MixedCase File Upload SQLi ( 10.4.57/11.5.50/12.4.45/13.4.30/14.3.2) Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47343	Jun 09, 2026	TYPO3 CMS <10.4.57/11-11.5.50/12-12.4.45/13-13.4.30/14-14.3.2: File Mount Auth Bypass Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.	TYPO3
CVE-2026-11607	Jun 09, 2026	TYPO3 CMS 14.3.3 Form Framework SQLi via .form.yaml Bypass Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47345	Jun 08, 2026	TYPO3/html-sanitizer <2.3.2 Namespace Attr Not Encoded XSS Bypass Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.	Html Sanitizer
CVE-2026-47344	Jun 08, 2026	TYPO3 html-sanitizer <2.3.2 WT XSS via ALLOW_INSECURE_RAW_TEXT When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.	Html Sanitizer
CVE-2026-46725	May 19, 2026	TYPO3 PHP Object Injection via Unserialized Cookie The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
CVE-2026-8827	May 19, 2026	TYPO3 Ext: Potential SQLi via AddressRepository::getSqlQuery() The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
CVE-2026-46724	May 19, 2026	TYPO3 File Indexer Path Traversal - Arbitrary Directory Indexing Abuse The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
CVE-2026-46723	May 19, 2026	Info Disclosure through Arbitrary Table Injection in TYPO3 Search Indexer The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
CVE-2026-46722	May 19, 2026	TYPO3 OOXML Indexer: XML External Entity (XXE) Exploit The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
CVE-2026-8726	May 19, 2026	TYPO3 Date Menu Plugin SQLi via Unauth URL The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
CVE-2026-46721	May 19, 2026	TYPO3 Frontend User Group Assignment Bypass (CVE-2026-46721) The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
CVE-2026-8727	May 19, 2026	RCE via unserialize in TYPO3 Crawler Ext from X-T3Crawler-Meta header The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
CVE-2026-6553	Apr 21, 2026	TYPO3 CMS 14.2.0: Backend password change stores cleartext in uc/user_settings Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.	TYPO3