TYPO3 Enterprise CMS

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any TYPO3 product.

RSS Feeds for TYPO3 security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in TYPO3 products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by TYPO3 Sorted by Most Security Vulnerabilities since 2018

TYPO393 vulnerabilities

TYPO3 Html Sanitizer6 vulnerabilities

TYPO3 Pharstreamwrapper2 vulnerabilities

TYPO3 Fluid1 vulnerability

TYPO3 Fluid Engine1 vulnerability

TYPO3 Form To Database1 vulnerability

TYPO3 Mediace1 vulnerability

TYPO3 Modules1 vulnerability

TYPO3 Svg Sanitizer1 vulnerability

By the Year

In 2026 there have been 32 vulnerabilities in TYPO3. Last year, in 2025 TYPO3 had 10 security vulnerabilities published. That is, 22 more vulnerabilities have already been reported in 2026 as compared to last year.

Year	Vulnerabilities	Average Score
2026	32	0.00
2025	10	0.00
2024	9	5.64
2023	7	5.60
2022	17	6.11
2021	16	6.37
2020	16	6.77
2019	8	9.03
2018	1	0.00

It may take a day or so for new TYPO3 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent TYPO3 Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-49742	Jun 09, 2026	TYPO3 CMS FAL Media Module file download flaw (v1114) Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-49741	Jun 09, 2026	TYPO3 CMS 14.014.3.3 FormFramework DataHandler Bypass Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.3.	TYPO3
CVE-2026-49740	Jun 09, 2026	TYPO3 CMS PHP Object Injection via VarFront/Reg deserialization (v<14) TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store or sys_registry database table) could inject a crafted serialized payload to trigger PHP Object Injection, potentially exploiting a gadget chain to achieve Remote Code Execution or other high-impact effects. Exploiting this vulnerability requires direct local write access to the storage, such as the SQL database or file system. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.	TYPO3
CVE-2026-49738	Jun 09, 2026	TYPO3 CMS Path Traversal in GeneralUtility::isAllowedAbsPath < 14.3.3 The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.	TYPO3
CVE-2026-47352	Jun 09, 2026	TYPO3 CMS File Meta Disclosure via Backend API < 10.4.57 Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.	TYPO3
CVE-2026-47351	Jun 09, 2026	TYPO3 CMS clipboard privilege escalation in v10.4-14.3 Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47350	Jun 09, 2026	Backend users were able to move records to a different page without having edit permissions on the source page Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.31 and 14.0.0-14.3.3.	TYPO3
CVE-2026-47349	Jun 09, 2026	Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.	TYPO3
CVE-2026-47348	Jun 09, 2026	Editors with access to create or modify page content were able to include HTML markup in page titles Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47347	Jun 09, 2026	Applications that use GeneralUtility::sanitizeLocalUrl to Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47346	Jun 09, 2026	Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.	TYPO3
CVE-2026-47343	Jun 09, 2026	Non-privileged backend users with file mount access were able to perform write operations (move Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.	TYPO3
CVE-2026-11607	Jun 09, 2026	Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.	TYPO3
CVE-2026-47345	Jun 08, 2026	TYPO3/html-sanitizer <2.3.2 Namespace Attr Not Encoded XSS Bypass Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.	Html Sanitizer
CVE-2026-47344	Jun 08, 2026	TYPO3 html-sanitizer <2.3.2 WT XSS via ALLOW_INSECURE_RAW_TEXT When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.	Html Sanitizer
CVE-2026-46725	May 19, 2026	TYPO3 PHP Object Injection via Unserialized Cookie The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.
CVE-2026-8827	May 19, 2026	TYPO3 Ext: Potential SQLi via AddressRepository::getSqlQuery() The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
CVE-2026-46724	May 19, 2026	TYPO3 File Indexer Path Traversal - Arbitrary Directory Indexing Abuse The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.
CVE-2026-46723	May 19, 2026	Info Disclosure through Arbitrary Table Injection in TYPO3 Search Indexer The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.
CVE-2026-46722	May 19, 2026	TYPO3 OOXML Indexer: XML External Entity (XXE) Exploit The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.
CVE-2026-8726	May 19, 2026	TYPO3 Date Menu Plugin SQLi via Unauth URL The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
CVE-2026-46721	May 19, 2026	TYPO3 Frontend User Group Assignment Bypass (CVE-2026-46721) The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.
CVE-2026-8727	May 19, 2026	RCE via unserialize in TYPO3 Crawler Ext from X-T3Crawler-Meta header The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.
CVE-2026-6553	Apr 21, 2026	TYPO3 CMS 14.2.0: Backend password change stores cleartext in uc/user_settings Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.	TYPO3
CVE-2026-4208	Mar 17, 2026	TYPO3 CMS MFA Code Reset Bypass via Empty String The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.
CVE-2026-4202	Mar 17, 2026	TYPO3 CMS Extension Redirect Record Leakage The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.
CVE-2026-1323	Mar 17, 2026	TYPO3 Deserialization RCE via Transport Spool The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].
CVE-2026-0895	Jan 20, 2026	TYPO3 FileSpool Insecure Deserialization via Extension The extension extends TYPO3 FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .
CVE-2026-0859	Jan 13, 2026	TYPO3 CMS mailfile spool deserialization PHP RCE (v10-14) TYPO3's mailfile spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.	TYPO3
CVE-2025-59022	Jan 13, 2026	TYPO3 CMS Arbitrary Data Deletion via Recycler (v10-14) Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.	TYPO3
CVE-2025-59021	Jan 13, 2026	TYPO3 CMS Unrestricted Redirect Modification (10-14) Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the users own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.	TYPO3
CVE-2025-59020	Jan 13, 2026	Fieldlevel access bypass in TYPO3 CMS 10-14 via defVals param By exploiting the defVals parameter, attackers could bypass fieldlevel access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.	TYPO3
CVE-2025-12998	Nov 12, 2025	TYPO3 Modules Ext: Improper Auth (<4.3.11, <5.7.4, <6.4.2, <7.5.5) Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.	Modules
CVE-2025-10316	Sep 16, 2025	CVE-2025-10316: XSS in Form to Database Extension <v 3.2.2, v4.2.3, v5.0.2 The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.	Form To Database
CVE-2025-59019	Sep 09, 2025	TYPO3 CMS Missing Auth Checks in CSV Download v11-13 Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.011.5.47, 12.0.012.4.36, and 13.0.013.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
CVE-2025-59018	Sep 09, 2025	TYPO3 CMS Workspace Auth Bypass via AJAX (v9–13) Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.09.5.54, 10.0.010.4.53, 11.0.011.5.47, 12.0.012.4.36, and 13.0.013.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.
CVE-2025-47940	May 20, 2025	TYPO3 Admin Priv Esc via Backend User in 10.0.0-13.4.12 LTS TYPO3 is an open source, PHP based web content management system. Starting in version 10.0.0 and prior to versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, administrator-level backend users without system maintainer privileges can escalate their privileges and gain system maintainer access. Exploiting this vulnerability requires a valid administrator account. Users should update to TYPO3 version 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.	TYPO3
CVE-2025-47939	May 20, 2025	TYPO3 FileManager Upload: Upload any file type, vulnerable before v13.4.12 TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be considered potentially harmful, such as executable binaries (e.g., `.exe` files), or files with inconsistent file extensions and MIME types (for example, a file incorrectly named with a `.png` extension but actually carrying the MIME type `application/zip`) starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS. Although such files are not directly executable through the web server, their presence can introduce indirect risks. For example, third-party services such as antivirus scanners or malware detection systems might flag or block access to the website for end users if suspicious files are found. This could negatively affect the availability or reputation of the site. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.	TYPO3
CVE-2025-47937	May 20, 2025	TYPO3 DBAL FrontendUser Permission Leak (9.0.0-13.4.12) TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.	TYPO3
CVE-2024-55893	Jan 14, 2025	TYPO3 CSRF via Deep Links in Backend UI (before 13.4.3) TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component Log Module allows attackers to remove log entries. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. There are no known workarounds for this vulnerability.	TYPO3
CVE-2024-55921	Jan 14, 2025	TYPO3 CSRF via Deep Links in Backend UI (Fixed in 13.4.3 LTS) TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component Extension Manager Module allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described.	TYPO3
CVE-2024-55924	Jan 14, 2025	TYPO3 <=11.5.41 CSRF via Deep Links & GET State Change TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. `security.backend.enforceReferrer` feature is disabled, 2. `BE/cookieSameSite` configuration is set to lax or none. The vulnerability in the affected downstream component Scheduler Module allows attackers to trigger pre-defined command classes - which can lead to unauthorized import or export of data in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS which fixes the problem described. There are no known workarounds for this vulnerability.	TYPO3
CVE-2024-34537	Oct 28, 2024	TYPO3 <13.3.1 Denial of Service via Bookmark Toolbar (ext:backend) TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the bookmark toolbar of the backend user interface. The fixed versions are 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1.	TYPO3
CVE-2024-34356	May 14, 2024	XSS in TYPO3 Form Manager (9.0.0-13.1.0) vulnerable until patched TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the form manager backend module is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to the form module. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1 fix the problem described.	TYPO3
CVE-2024-34355	May 14, 2024	TYPO3 v13.0.0-13.1.1: History Backend Module HTML Injection TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML injection. Although Content-Security-Policy headers effectively prevent JavaScript execution, adversaries can still inject malicious HTML markup. Exploiting this vulnerability requires a valid backend user account. TYPO3 version 13.1.1 fixes the problem described.	TYPO3
CVE-2024-34358	May 14, 2024	TYPO3 ShowImageController HMAC Bypass Unbounded Thumbnail Creation (pre-9.5.48) TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.	TYPO3
CVE-2024-34357	May 14, 2024	XSS in TYPO3 ShowImageController (_eID) before 13.1.1 TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, failing to properly encode user-controlled values in file entities, the `ShowImageController` (`_eID tx_cms_showpic_`) is vulnerable to cross-site scripting. Exploiting this vulnerability requires a valid backend user account with access to file entities. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.	TYPO3
CVE-2024-25121	Feb 13, 2024	TYPO3 FAL DataHandler RCE via fallback storage (8.713.0.1) TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which fix the problem described. When persisting entities of the File Abstraction Layer directly via DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata` entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using `$dataHandler->isImporting = true;`.	TYPO3
CVE-2024-25120	Feb 13, 2024	Unauthorized Resource Access via t3:// URI in TYPO3 8.7-13.0 (fixed in 8.7.57+) TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.	TYPO3
CVE-2024-25119	Feb 13, 2024	TYPO3 Install Tool plaintext encryptionKey disclosure TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this vulnerability.	TYPO3