.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

typo3/cms-core 9.5.8 vulnerabilities

128 advisories known · typo3/cms-core@9.5.8 · 66 affect this release · Dependencies not checked · showing first 100

SEVERITYADVISORYPUBLISHED

Affects 9.5.8

SEVERITYADVISORYPUBLISHED

HighTYPO3 is vulnerable to Cross-Site Scripting via frontend renderingGHSA-r4f8-f93x-5qh3BIT-typo3-2023-24814CVE-2023-24814Affected >=10.0.0 <10.4.36, >=11.0.0 <11.5.23, >=12.0.0 <12.2.0, >=8.7.0 <8.7.51, >=9.0.0 <9.5.40Fixed in 10.4.36 Fixed in 11.5.23 Fixed in 12.2.0 Fixed in 8.7.51 Fixed in 9.5.40OSV source ↗4 years ago

HighTYPO3 Insecure Deserialization in Query Generator & Query ViewGHSA-rcgc-4xfc-564vCVE-2019-19849Affected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

HighMissing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSGHSA-m5vr-3m74-jwxpBIT-typo3-2020-15098CVE-2020-15098Affected >=10.0.0 <10.4.6, >=9.0.0 <9.5.20Fixed in 10.4.6 Fixed in 9.5.20OSV source ↗6 years ago

HighInsecure Deserialization in Backend User Settings in TYPO3 CMSGHSA-2wj9-434x-9hvpBIT-typo3-2020-11067CVE-2020-11067Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighClass destructors causing side-effects when being unserialized in TYPO3 CMSGHSA-2rxh-h6h9-qrqcBIT-typo3-2020-11066CVE-2020-11066Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighUnrestricted File Upload in Form FrameworkGHSA-2r6j-862c-m2v2BIT-typo3-2021-21355CVE-2021-21355Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

HighBroken Access Control in Form FrameworkGHSA-3vg7-jw9m-pc3fBIT-typo3-2021-21357CVE-2021-21357Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

HighTYPO3 Possible Insecure Deserialization in Extbase Request HandlingGHSA-5h5v-m596-r6rfAffected >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

HighCleartext storage of session identifierGHSA-954j-f27r-cj52BIT-typo3-2020-26228CVE-2020-26228Affected >=10.0.0 <10.4.10, >=8.7.0 <8.7.38, >=9.0.0 <9.5.23Fixed in 10.4.10 Fixed in 8.7.38 Fixed in 9.5.23OSV source ↗6 years ago

HighExposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSGHSA-3x94-fv5h-5q2cBIT-typo3-2020-15099CVE-2020-15099Affected >=10.0.0 <10.4.6, >=9.0.0 <9.5.20Fixed in 10.4.6 Fixed in 9.5.20OSV source ↗6 years ago

HighTYPO3 CMS has Broken Access Control in its Form FrameworkGHSA-pjpj-v387-x4vqCVE-2026-11607Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

HighTYPO3 CMS: Destructive Actions on File Mount FoldersGHSA-3v8v-4wg6-r7qhCVE-2026-47343Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

HighTYPO3 CMS has Broken Access Control in its Form FrameworkGHSA-hwvq-2w67-rvxpCVE-2026-47346Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

HighBackend Same-Site Request Forgery in TYPO3 CMSGHSA-pqg8-crx9-g8m4BIT-typo3-2020-11069CVE-2020-11069Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

HighTYPO3 CMS vulnerable to Arbitrary Code Execution via Form FrameworkGHSA-c5wx-6c2c-f7rmBIT-typo3-2022-23503CVE-2022-23503Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1, >=8.0.0 <8.7.49, >=9.0.0 <9.5.38Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1 Fixed in 8.7.49 Fixed in 9.5.38OSV source ↗4 years ago

HighTYPO3 Install Tool vulnerable to Code ExecutionGHSA-5w2h-59j3-8x5wCVE-2024-22188Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

HighTYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data HandlerGHSA-rj3x-wvc6-5j66CVE-2024-25121Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

MediumTYPO3 Directory Traversal on ZIP extractionGHSA-77p4-wfr8-977wCVE-2019-19848Affected >=10.0.0 <10.2.2, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.2 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

MediumCross-Site Scripting in Backend Grid ViewGHSA-rgcg-28xm-8mmwBIT-typo3-2021-32669CVE-2021-32669Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=8.0.0 <8.7.41, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 8.7.41 Fixed in 9.5.28OSV source ↗5 years ago

MediumCross-Site Scripting in Query Generator & Query ViewGHSA-6mh3-j5r5-2379BIT-typo3-2021-32668CVE-2021-32668Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=8.0.0 <8.7.41, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 8.7.41 Fixed in 9.5.28OSV source ↗5 years ago

MediumCross-Site Scripting in Page PreviewGHSA-8mq9-fqv8-59wfBIT-typo3-2021-32667CVE-2021-32667Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 9.5.28OSV source ↗5 years ago

MediumTYPO3 Cross-Site Scripting in Filelist ModuleGHSA-6xwf-7rfm-4gwcAffected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Link HandlingGHSA-4ppr-jw47-9qm5Affected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Form Framework validation handlingGHSA-95qm-3xp7-vfj5Affected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗2 years ago

MediumTYPO3 HTML Sanitizer Bypasses Cross-Site Scripting ProtectionGHSA-gqqf-g5r7-84vfAffected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32 Fixed in 11.5.16 Fixed in 7.6.58 Fixed in 8.7.48 Fixed in 9.5.37OSV source ↗4 years ago

MediumCross-Site Scripting via Rich-Text ContentGHSA-c5c9-8c6m-727vBIT-typo3-2021-32768CVE-2021-32768Affected >=10.0.0 <10.4.19, >=11.0.0 <11.3.2, >=7.0.0 <7.6.53, >=8.0.0 <8.7.42, >=9.0.0 <9.5.29Fixed in 10.4.19 Fixed in 11.3.2 Fixed in 7.6.53 Fixed in 8.7.42 Fixed in 9.5.29OSV source ↗5 years ago

MediumOpen Redirection in Login HandlingGHSA-4jhw-2p6j-5wmpBIT-typo3-2021-21338CVE-2021-21338Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=6.2.0 <6.2.57, >=7.0.0 <7.6.51, >=8.0.0 <8.7.40, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 6.2.57 Fixed in 7.6.51 Fixed in 8.7.40 Fixed in 9.5.25OSV source ↗6 years ago

MediumCross-Site Scripting in Fluid view helpersGHSA-vqqx-jw6p-q3rfBIT-typo3-2020-26227CVE-2020-26227Affected >=10.0.0 <10.4.10, >=8.7.0 <8.7.38, >=9.0.0 <9.5.23Fixed in 10.4.10 Fixed in 8.7.38 Fixed in 9.5.23OSV source ↗6 years ago

MediumTYPO3 CMS has Broken Access Control in the Recycler ModuleGHSA-f34x-rx2w-7pm3CVE-2026-47349Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 CMS has an Open Redirect Vulnerability via Core UtilitiesGHSA-3p42-w5ch-gg42CVE-2026-47347Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 CMS has Insecure Deserialization via Core APIGHSA-c78m-c52x-jgwpCVE-2026-49740Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 CMS has Broken Access Control in Backend APIGHSA-2j54-93q2-3hjqCVE-2026-47352Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 CMS: Broken Access Control in Media ModuleGHSA-q93m-25xv-94hhCVE-2026-47351Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 CMS exposes sensitive information in an error messageGHSA-cvm2-5f78-g9m8CVE-2025-59016Affected >=13.0.0 <13.4.18, >=9.0.0 <12.4.37Fixed in 12.4.37 Fixed in 13.4.18OSV source ↗last year

MediumTYPO3 CMS has an open‐redirect vulnerabilityGHSA-72jf-5fg5-3cw3CVE-2025-59013Affected >=13.0.0 <13.4.18, >=9.0.0 <12.4.37Fixed in 12.4.37 Fixed in 13.4.18OSV source ↗last year

MediumInsufficient Session Expiration in TYPO3's Admin ToolGHSA-wwjw-r3gj-39fqBIT-typo3-2022-31050CVE-2022-31050Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 9.5.35OSV source ↗4 years ago

MediumTYPO3 CMS vulnerable to Weak Authentication in Frontend LoginGHSA-jfp7-79g7-89rfBIT-typo3-2022-23501CVE-2022-23501Affected <8.7.49, >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1, >=9.0.0 <9.5.38Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1 Fixed in 8.7.49 Fixed in 9.5.38OSV source ↗4 years ago

MediumTYPO3 CMS vulnerable to Denial of Service in Page Error HandlingGHSA-8c28-5mp7-v24hBIT-typo3-2022-23500CVE-2022-23500Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=9.0.0 <9.5.38Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 9.5.38OSV source ↗4 years ago

MediumDenial of Service in Page Error HandlingGHSA-4p9g-qgx9-397pBIT-typo3-2021-21359CVE-2021-21359Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

MediumCleartext storage of session identifierGHSA-qx3w-4864-94chBIT-typo3-2021-21339CVE-2021-21339Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=6.2.0 <6.2.57, >=7.0.0 <7.6.51, >=8.0.0 <8.7.40, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 6.2.57 Fixed in 7.6.51 Fixed in 8.7.40 Fixed in 9.5.25OSV source ↗6 years ago

MediumTYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site ConfigurationGHSA-8w3p-qh3x-6gjrBIT-typo3-2022-23504CVE-2022-23504Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1, >=9.0.0 <9.5.38Fixed in 10.4.33 Fixed in 11.5.20 Fixed in 12.1.1 Fixed in 9.5.38OSV source ↗4 years ago

MediumPath Traversal in TYPO3 File Abstraction Layer StoragesGHSA-w6x2-jg8h-p6mpBIT-typo3-2023-30451CVE-2023-30451Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

MediumTYPO3 SQL Injection in low-level Query GeneratorGHSA-59pj-7mjh-4465CVE-2019-19850Affected >=10.0 <10.2.2, >=8.0 <8.7.30, >=9.0 <9.5.12Fixed in 10.2.2 Fixed in 8.7.30 Fixed in 9.5.12OSV source ↗4 years ago

MediumTYPO3 Allows Unrestricted File Upload in File Abstraction LayerGHSA-9hq9-cr36-4wpjCVE-2025-47939Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50 Fixed in 11.5.44 Fixed in 12.4.31 Fixed in 13.4.12 Fixed in 9.5.51OSV source ↗last year

MediumTYPO3 vulnerable to Cross-Site Scripting in the ShowImageControllerGHSA-hw6c-6gwq-3m3mCVE-2024-34357Affected >=10.0.0 <10.4.45, >=11.0.0 <11.5.37, >=12.0.0 <12.4.15, >=13.0.0 <13.1.1, >=9.0.0 <9.5.48Fixed in 10.4.45 Fixed in 11.5.37 Fixed in 12.4.15 Fixed in 13.1.1 Fixed in 9.5.48OSV source ↗2 years ago

MediumTYPO3 vulnerable to Cross-Site Scripting in the Form Manager ModuleGHSA-v6mw-h7w6-59w3CVE-2024-34356Affected >=10.0.0 <10.4.45, >=11.0.0 <11.5.37, >=12.0.0 <12.4.15, >=13.0.0 <13.1.1, >=9.0.0 <9.5.48Fixed in 10.4.45 Fixed in 11.5.37 Fixed in 12.4.15 Fixed in 13.1.1 Fixed in 9.5.48OSV source ↗2 years ago

MediumTYPO3 CMS Stored Cross-Site Scripting via FileDumpControllerGHSA-9c6w-55cp-5w25BIT-typo3-2022-36107CVE-2022-36107Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32 Fixed in 11.5.16 Fixed in 7.6.58 Fixed in 8.7.48 Fixed in 9.5.37OSV source ↗4 years ago

MediumCross-Site Scripting in TYPO3's Frontend Login MailerGHSA-h4mx-xv96-2jgmBIT-typo3-2022-31049CVE-2022-31049Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 9.5.35OSV source ↗4 years ago

MediumCross-Site Scripting in TYPO3's Form FrameworkGHSA-3r95-23jp-mhvgBIT-typo3-2022-31048CVE-2022-31048Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 8.7.47 Fixed in 9.5.35OSV source ↗4 years ago

MediumCross-Site Scripting in Content Preview (CType menu)GHSA-x7hc-x7fm-f7qhBIT-typo3-2021-21370CVE-2021-21370Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14 Fixed in 11.1.1 Fixed in 9.5.25OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Link HandlingGHSA-4j77-gg36-9864BIT-typo3-2020-11065CVE-2020-11065Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumCross-Site Scripting in TYPO3 CMS Form EngineGHSA-43gj-mj2w-wh46BIT-typo3-2020-11064CVE-2020-11064Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2 Fixed in 9.5.17OSV source ↗6 years ago

MediumTYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageControllerGHSA-36g8-62qv-5957CVE-2024-34358Affected >=10.0.0 <10.4.45, >=11.0.0 <11.5.37, >=12.0.0 <12.4.15, >=13.0.0 <13.1.1, >=9.0.0 <9.5.48Fixed in 10.4.45 Fixed in 11.5.37 Fixed in 12.4.15 Fixed in 13.1.1 Fixed in 9.5.48OSV source ↗2 years ago

MediumTYPO3 CMS vulnerable to User Enumeration via Response TimingGHSA-m392-235j-9r7rBIT-typo3-2022-36105CVE-2022-36105Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32 Fixed in 11.5.16 Fixed in 7.6.58 Fixed in 8.7.48 Fixed in 9.5.37OSV source ↗4 years ago

MediumInsertion of Sensitive Information into Log File in typo3/cms-coreGHSA-fh99-4pgr-8j99BIT-typo3-2022-31047CVE-2022-31047Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=7.0.0 <7.6.57, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 7.6.57 Fixed in 8.7.47 Fixed in 9.5.35OSV source ↗4 years ago

MediumInformation Disclosure in User AuthenticationGHSA-34fr-fhqr-7235BIT-typo3-2021-32767CVE-2021-32767Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=7.0.0 <7.6.52, >=8.0.0 <8.7.41, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 7.6.52 Fixed in 8.7.41 Fixed in 9.5.28OSV source ↗5 years ago

MediumTYPO3 Install Tool vulnerable to Information Disclosure of Encryption KeyGHSA-h47m-3f78-qp9gCVE-2024-25119Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

MediumTYPO3 Potential Open Redirect via Parsing DifferencesGHSA-2fx5-pggv-6jjrCVE-2024-55892Affected >=10.0.0 <10.4.48, >=11.0.0 <11.5.42, >=12.0.0 <12.4.25, >=13.0.0 <13.4.3, >=9.0.0 <9.5.49Fixed in 10.4.48 Fixed in 11.5.42 Fixed in 12.4.25 Fixed in 13.4.3 Fixed in 9.5.49OSV source ↗2 years ago

MediumTYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI SchemeGHSA-wf85-8hx9-gj7cCVE-2024-25120Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

MediumTYPO3 Backend Forms vulnerable to Information Disclosure of Hashed PasswordsGHSA-38r2-5695-334wCVE-2024-25118Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

MediumInformation Disclosure via Export ModuleGHSA-8gmv-9hwg-w89gBIT-typo3-2022-31046CVE-2022-31046Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=7.0.0 <7.6.57, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 7.6.57 Fixed in 8.7.47 Fixed in 9.5.35OSV source ↗4 years ago

MediumTYPO3 vulnerable to Weak Authentication in Session HandlingGHSA-3vmm-7h4j-69rmBIT-typo3-2023-47127CVE-2023-47127Affected >=10.0.0 <10.4.41, >=11.0.0 <11.5.33, >=12.0.0 <12.4.8, >=8.0.0 <8.7.55, >=9.0.0 <9.5.44Fixed in 10.4.41 Fixed in 11.5.33 Fixed in 12.4.8 Fixed in 8.7.55 Fixed in 9.5.44OSV source ↗3 years ago

LowTYPO3 Unverified Password Change for Backend UsersGHSA-3jrg-97f3-rqh9CVE-2025-47938Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50 Fixed in 11.5.44 Fixed in 12.4.31 Fixed in 13.4.12 Fixed in 9.5.51OSV source ↗last year

LowTYPO3 Allows Information Disclosure via DBAL Restriction HandlingGHSA-x8pv-fgxp-8v3xCVE-2025-47937Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50 Fixed in 11.5.44 Fixed in 12.4.31 Fixed in 13.4.12 Fixed in 9.5.51OSV source ↗last year

LowInformation Disclosure due to Out-of-scope Site ResolutionGHSA-jq6g-4v5m-wm9rBIT-typo3-2023-38499CVE-2023-38499Affected >=10.0.0 <10.4.39, >=11.0.0 <11.5.30, >=12.0.0 <12.4.4, >=9.4.0 <9.5.42Fixed in 10.4.39 Fixed in 11.5.30 Fixed in 12.4.4 Fixed in 9.5.42OSV source ↗3 years ago

LowTYPO3 CMS has Broken Access Control in its File Abstraction LayerGHSA-jf56-v8jc-jcc5CVE-2026-49738Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

Does not affect 9.5.8

SEVERITYADVISORYPUBLISHED

CriticalTYPO3 CMS Insecure Deserialization & Arbitrary Code ExecutionGHSA-cc97-g92w-jm65Affected >=7.0.0 <7.6.30, >=8.0.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 7.6.30 Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighTYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend APIGHSA-x428-565f-8xj2Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗2 years ago

HighTYPO3 Arbitrary Code Execution via File List ModuleGHSA-f9hr-7cfq-mjg2Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

HighTYPO3 Vulnerable to Insecure DeserializationGHSA-86hp-xrhj-fhpqCVE-2019-12747Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗4 years ago

HighCross-Site-Request-Forgery in BackendGHSA-657m-v5vm-f6rwBIT-typo3-2021-41113CVE-2021-41113Affected >=11.2.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago

HighTYPO3 Security Misconfiguration in Frontend Session HandlingGHSA-82vp-jr39-4j2jAffected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗2 years ago

HighTYPO3 CMS - Broken Access Control in Backend and Install ToolGHSA-68jx-f42c-7599CVE-2026-19418Affected >=14.0.0 <14.3.6Fixed in 14.3.6OSV source ↗2 months ago

HighTYPO3 CMS has Privilege Escalation & SQL Injection in its Form FrameworkGHSA-jh32-v29g-68pqCVE-2026-49741Affected >=14.0.0 <14.3.3Fixed in 14.3.3OSV source ↗5 months ago

HighTYPO3 CMS has Broken Access Control in its Media ModuleGHSA-chm7-4vch-h8vrCVE-2026-49742Affected >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

HighTYPO3 Security Misconfiguration for Backend User AccountsGHSA-rxc9-f2x6-qh4wAffected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

HighTYPO3 Denial of Service in Frontend Record RegistrationGHSA-hjx5-v9xg-7h25Affected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21Fixed in 7.6.32 Fixed in 8.7.21OSV source ↗2 years ago

HighTYPO3 Security Misconfiguration in Install Tool CookieGHSA-ppvg-hw62-6ph9Affected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

HighTYPO3 CMS Insecure DeserializationGHSA-96jg-pmc4-cx39Affected >=8.5.0 <8.7.17, >=9.0.0 <9.3.1Fixed in 8.7.17 Fixed in 9.3.1OSV source ↗2 years ago

HighTYPO3 CMS Privilege Escalation and SQL InjectionGHSA-45wj-jv2h-jwrfAffected >=8.5.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighTYPO3 CMS Authentication Bypass vulnerabilityGHSA-x4rj-f7m6-42c3Affected >=7.0.0 <7.6.30, >=8.0.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 7.6.30 Fixed in 8.7.17 Fixed in 9.3.2OSV source ↗2 years ago

HighTYPO3 Image Processing susceptible to Code ExecutionGHSA-3w4h-r27h-4r2wCVE-2019-11832Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗4 years ago

HighTYPO3 SQL injection vulnerability in the Extbase FrameworkGHSA-m64j-j252-jxmrCVE-2013-1842Affected >=4.5.0 <4.5.24, >=4.6.0 <4.6.17, >=4.7.0 <4.7.9, >=6.0.0 <6.0.3Fixed in 4.5.24 Fixed in 4.6.17 Fixed in 4.7.9 Fixed in 6.0.3OSV source ↗4 years ago

HighTYPO3 Allows Privilege Escalation to System MaintainerGHSA-6frx-j292-c844CVE-2025-47940Affected >=10.4.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12Fixed in 10.4.50 Fixed in 11.5.44 Fixed in 12.4.31 Fixed in 13.4.12OSV source ↗last year

HighDeserialization of untrusted data in SymfonyGHSA-w2fr-65vp-mxw3CVE-2019-10912Affected >=9.0.0 <9.5.8Fixed in 9.5.8OSV source ↗7 years ago

MediumTYPO3 CMS uses insufficient entropy when generating passwordsGHSA-p5jq-5383-qvc7CVE-2025-59015Affected >=12.0.0 <12.4.37, >=13.0.0 <13.4.18Fixed in 12.4.37 Fixed in 13.4.18OSV source ↗last year

MediumTYPO3 Security Misconfiguration in User Session HandlingGHSA-xmgr-jff3-fcfvAffected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗2 years ago

MediumTYPO3 Broken Access Control in Localization HandlingGHSA-9rx9-7fmh-gj3gAffected >=8.0.0 <8.7.23Fixed in 8.7.23OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Form FrameworkGHSA-4459-qrcc-vfcfAffected >=8.5.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Language Pack HandlingGHSA-76r3-m635-p3vcAffected >=9.2.0 <9.5.4Fixed in 9.5.4OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Frontend User LoginGHSA-8c25-vj2w-p72jAffected >=7.1.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Backend Modal ComponentGHSA-g4c9-qfvw-fmr4Affected >=7.1.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Cross-Site Scripting in Online Media Asset RenderingGHSA-wg8h-gxf4-g4ghAffected >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 HTML Sanitizer Bypasses Cross-Site Scripting ProtectionGHSA-47m6-46mj-p235CVE-2022-36020Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32 Fixed in 11.5.16OSV source ↗4 years ago

MediumTypo3 Cross-Site Scripting in Link HandlingGHSA-r6fv-56gp-j3r4CVE-2019-12748Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27 Fixed in 9.5.8OSV source ↗4 years ago

MediumCkeditor XSS VulnerabilityGHSA-g68x-vvqq-pvw3CVE-2018-17960Affected >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗8 years ago

MediumBootstrap Cross-site Scripting vulnerabilityGHSA-pj7m-g53m-7638CVE-2018-14041Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗8 years ago

MediumTYPO3 CMS has Broken Access Control in its DataHandlerGHSA-qcmw-6rm2-5x78CVE-2026-47350Affected >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 CMS has Cross-Site Scripting in Indexed SearchGHSA-cg75-qfg2-w9hjCVE-2026-47348Affected >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

MediumTYPO3 CMS Allows Insecure Deserialization via Mailer File SpoolGHSA-7vp9-x248-9vr9CVE-2026-0859Affected >=10.0.0 <10.4.55, >=11.0.0 <11.5.49, >=12.0.0 <12.4.41, >=13.0.0 <13.4.23, >=14.0.0 <14.0.2Fixed in 10.4.55 Fixed in 11.5.49 Fixed in 12.4.41 Fixed in 13.4.23 Fixed in 14.0.2OSV source ↗10 months ago