Typo3
Monthly
Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous visitors to read pages that should be protected by extendToSubpages-inherited frontend-group restrictions. The extension fails to isolate its forged access-restriction state during indexer sub-requests, writing empty frontend-group and subpage-inheritance flags into the shared TYPO3 rootline cache, where they persist and serve subsequent user requests without the original restrictions applied. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.6 with combined high confidentiality and integrity impact reflects meaningful severity for any TYPO3 deployment relying on page-level inherited access controls.
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. No public exploit code has been identified at time of analysis, though the vulnerability class is well-understood and commonly weaponized; the CVSS 4.0 score of 7.7 reflects the severe potential impact tempered by meaningful exploitation preconditions.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
The femanager extension for TYPO3 CMS incorrectly accepts a regular user confirmation hash - obtainable by any visitor via the public resend-confirmation action - in place of the privileged admin confirmation token when processing account-approval requests. This allows a registrant whose account is pending administrator authorization to self-approve that account, fully bypassing the admin-approval gate. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial given the public exposure of the prerequisite token; the CVSS 4.0 score of 8.3 reflects high confidentiality impact against the vulnerable system.
Insecure Direct Object Reference in the TYPO3 femanager extension exposes frontend user profile data - including name, email address, date of birth, and postal address - to any unauthenticated visitor who can reach the Detail or List plugin. The extension's user detail view accepts a caller-supplied user ID without validating that the requested record belongs to the configured or authenticated target, making horizontal privilege escalation trivial via ID enumeration. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. The vendor (TYPO3, advisory TYPO3-EXT-SA-2026-022) reports active exploitation in the wild, and the flaw is unauthenticated (CVSS 4.0 base 9.5, PR:N).
SQL injection in the TYPO3 'Forms Export' backend extension allows a low-privileged authenticated backend user to inject arbitrary SQL through a URL parameter, yielding high-impact access to the underlying database (confidentiality, integrity, and availability). Exploitation is constrained to users with at least read access to the Forms Export backend module, limiting the attack surface to the TYPO3 administrative backend. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential database impact.
Remote code execution in the TYPO3 'HTML5 Video Player vs. Powermail' extension allows a remote, unauthenticated attacker to achieve arbitrary code execution on the server by supplying a crafted serialized value in an attacker-controlled cookie that is passed to PHP's unserialize(). The flaw is a classic PHP Object Injection (CWE-502) with full confidentiality, integrity, and availability impact and a CVSS 4.0 base score of 9.3. No public exploit identified at time of analysis, but the trivial attack requirements make weaponization straightforward.
Unauthenticated record tampering in the TYPO3 Telephone Directory extension allows any visitor who can identify an employee UID to overwrite that employee's data via a direct POST request, bypassing HMAC-based edit-link authorization entirely. The extension enforces HMAC validation only at the form-render step, leaving the persistence action unprotected under CWE-862 (Missing Authorization). With a CVSS 4.0 score of 8.7 and an attack profile of network-accessible, no-privilege, no-interaction, no public exploit has been identified at time of analysis, but the attack requires no authentication and minimal attacker capability.
Unauthenticated record takeover in the TYPO3 'Club Directory' extension allows any visitor to overwrite or force-publish arbitrary club records by supplying a known record UID in requests to the frontend edit, update, and activate actions. The extension resolves records directly from user-controlled input without performing any ownership or authorization check, making this a textbook CWE-862 (Missing Authorization) / IDOR vulnerability. No public exploit has been identified at time of analysis, but exploitation is trivially simple given the network-accessible attack surface, absence of authentication, and sequential nature of TYPO3 record UIDs.
Broken access control in the TYPO3 Industry Directory extension allows unauthenticated network visitors to overwrite company records they do not own. The frontend edit form is gated by a template-level visibility flag, but the server-side write controller performs no corresponding ownership verification, making the UI restriction trivially bypassable via direct HTTP submission using any publicly visible record identifier. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication requirements and low attack complexity make independent exploitation straightforward against any exposed deployment.
Missing server-side ownership verification in the TYPO3 Forum extension allows any unauthenticated visitor to overwrite the content of any forum topic. Because topic identifiers are enumerable from the public forum listing, an attacker needs no credentials, special access, or non-default configuration to target arbitrary topics. The CVSS 4.0 score of 8.8 reflects high integrity impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized organizer attribution in the TYPO3 Events 2 frontend management extension allows any authenticated organizer-role user to create events falsely attributed to another organizer's record by supplying a foreign organizer identifier in the event creation request. The flaw stems from a permission check that validates only the presence of any organizer role rather than verifying the submitting user's ownership of the specific organizer referenced in the request. No public exploit has been identified and this vulnerability is absent from CISA KEV; however, the CVSS 4.0 score of 7.1 reflects a high integrity impact on the vulnerable system driven by straightforward, low-privilege network exploitation with no additional attack requirements.
Cross-organizer event modification in the TYPO3 Events 2 extension allows any authenticated frontend event manager to tamper with events owned by other organizers. The frontend management update flow performs its authorization check against a different event identifier than the one the request ultimately modifies - a textbook CWE-639 IDOR mismatch - granting write access beyond the user's legitimate scope. No public exploit has been identified at time of analysis, but with a CVSS 4.0 score of 7.1 (VI:H) and only low-privilege authentication required (PR:L), the integrity risk is meaningful in any multi-organizer TYPO3 deployment.
Unauthenticated account takeover in the TYPO3 femanager extension 8.x allows a remote attacker to reset the password of and re-enable any existing frontend user account - including disabled or deleted ones - by exploiting an invitation controller that continues processing after issuing a redirect on invalid input. No prior authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, but the impact is severe: full account takeover of arbitrary frontend users in any TYPO3 installation running femanager 8.x.
Broken referrer enforcement in TYPO3 CMS backend and Install Tool allows an attacker with JavaScript execution capability on any of the site's own domains to invoke privileged backend routes and Install Tool endpoints using an authenticated victim's session. The regression was introduced in TYPO3 13.0.0 when both the backend and Install Tool were moved to serve from the site root entry point rather than the dedicated `/typo3/` subdirectory, causing the `ReferrerEnforcer` to accept any same-origin Referer header as legitimate backend traffic. Affected versions are TYPO3 CMS 13.0.0-13.4.33 and 14.0.0-14.3.5; no public exploit code has been identified at time of analysis.
Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbitrary PHP code by sending a crafted cookie that the extension feeds directly into PHP's unserialize(). The flaw (CWE-502, CVSS 4.0 score 9.2) is exploitable only on installations where a content element is configured with 'Persistent Mode: Static'. No public exploit identified at time of analysis, though the deserialization pattern is well-understood and typically rapid to weaponize.
SQL injection in the TYPO3 'address_list' extension's AddressRepository::getSqlQuery() method allows remote attackers to manipulate database queries when the method is called with untrusted input. The flaw is latent - the vulnerable method is not invoked anywhere within the extension itself, so default installations are not exposed, but custom or third-party extensions that reuse this method become injection sinks. No public exploit identified at time of analysis, and no EPSS or KEV signal accompanies the advisory.
SQL injection in the TYPO3 'news' extension allows unauthenticated remote attackers to inject arbitrary SQL through a URL parameter on pages that render the 'Date Menu of news articles' plugin. The flaw stems from missing sanitization of user input before it reaches a database query, and exposure is limited to sites that both use the affected plugin and have not enabled the TypoScript/plugin setting disableOverrideDemand. No public exploit identified at time of analysis.
Remote code execution in the TYPO3 Crawler extension occurs when the X-T3Crawler-Meta response header from a crawled URL is passed unchecked to PHP's unserialize(), enabling arbitrary PHP object injection. Exploitation requires a high-privileged administrator to configure a crawler-enabled page and a Scheduler task pointing at an attacker-controlled endpoint, so while impact is full RCE on the TYPO3 host, it is gated by an unusual combination of admin access, user interaction, and externally reachable malicious URLs. No public exploit identified at time of analysis and no CISA KEV listing.
TYPO3 CMS 14.2.0 stores backend user passwords in cleartext within database fields (uc, user_settings) when passwords are changed through the user settings module. Remote attackers with database read access or exploiting SQL injection vulnerabilities can retrieve plaintext credentials for backend administrator accounts. Vendor patch available via GitHub commit 9a6e913f. No active exploitation confirmed at time of analysis, though high CVSS subsequent system impact scores (SC:H/SI:H/SA:H) indicate potential for privilege escalation if database is compromised.
CVE-2026-4208 is a security vulnerability (CVSS 7.7). High severity vulnerability requiring prompt remediation.
Arbitrary PHP code execution in TYPO3 CMS versions 10.0.0 through 14.0.1 through unsafe deserialization of mail spool files, allowing local attackers with write access to the spool directory to execute malicious code when the mailer:spool:send command is executed. Affected versions span multiple release lines including 10.x, 11.x, 12.x, 13.x, and 14.x, requiring immediate patching to prevent web server compromise.
Unauthorized information disclosure in TYPO3 CMS backend localization wizard exposes records and content elements outside a low-privileged user's permitted access scope. Multiple AJAX endpoints in the PHP LocalizationController - used to drive the multi-step translation wizard - accept arbitrary record UIDs without performing authorization checks, allowing any authenticated backend user to query metadata about content they should not be able to see. All actively maintained TYPO3 major branches (10.x through 14.x) are affected, vendor patches are available, and no public exploit or active exploitation has been identified at time of analysis.
Frontend detail-view document lookup in the Apache Solr for TYPO3 Enterprise Search extension bypasses both the siteHash isolation filter and frontend user access controls, allowing retrieval of Solr-indexed documents outside normal authorization constraints. An unauthenticated visitor who obtains or guesses a valid Solr document ID can access content restricted to specific sites or authenticated frontend users by querying the detail-view endpoint directly, circumventing the access controls enforced on the regular search path. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects that exploitation depends on obtaining valid document IDs.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.
Unauthorized database field disclosure in the TYPO3 "Modules" extension allows any authenticated low-privileged backend user to read arbitrary database field values - including backend and frontend user password hashes - by supplying user-controlled table, field, and record parameters to an unprotected AJAX inline editing endpoint. The authorization check protecting which fields a given user may view or modify is entirely absent from this endpoint, meaning any backend session holder with module access can query sensitive records regardless of their configured permissions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the attack requires only a valid TYPO3 backend login, making it a meaningful insider privilege-escalation risk in multi-user installations.
Unauthorized event disclosure in the TYPO3 "Event Management and Registration" extension allows unauthenticated remote users to view hidden or time-restricted events by supplying a demand-override query parameter that the extension fails to validate against its own enable-field restrictions. The vulnerability (CWE-862, Missing Authorization) is exploitable against any deployment where the `disableOverrideDemand` plugin setting is not explicitly activated - making non-hardened installs vulnerable by default. No public exploit code has been identified at time of analysis, and CVSS 4.0 scores this at 6.3 Medium with low confidentiality impact and no integrity or availability consequence.
Insufficient JWT expiration validation in the TYPO3 'Syssy - TYPO3 Monitoring & Security Checks' extension allows an attacker already in possession of a valid SYSSY project API key to authenticate using an expired token, bypassing the intended session time boundary (CWE-613). The limited confidentiality and integrity impact (VC:L/VI:L per the CVSS 4.0 vector) reflects access to monitoring and security check data rather than full system compromise. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Cleartext transmission of TYPO3 system information occurs in the Syssy - TYPO3 Monitoring & Security Checks extension when OpenSSL is absent on the hosting server, exposing potentially sensitive configuration and system data to network interception (CWE-319). All tracked versions of the extension are affected per CPE data, though exploitation is constrained by the dual requirement of OpenSSL being unavailable and the attacker already possessing the SYSSY project's API key. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.3 reflects the medium-severity, partially-authenticated nature of the flaw.
Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.
Path traversal in the TYPO3 Mask extension allows authenticated backend users with Mask module access to create or delete arbitrary .html files outside the configured template directory. The flaw stems from the extension's failure to validate client-supplied template element keys before using them to construct filesystem paths for saving and deleting Mask template files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity impact is concrete - an attacker can overwrite or remove .html files anywhere the TYPO3 web process has write access.
HTML serialization in typo3/html-sanitizer before version 2.3.2 fails to encode namespace attributes (xmlns:*), allowing an authenticated low-privilege attacker to inject unsanitized XSS payloads that execute in victims' browsers. The vulnerability bypasses the library's core XSS prevention purpose: crafted namespace attribute values containing raw HTML (e.g., onerror handlers) survive the sanitizer and render as executable markup. No public exploit has been independently identified at time of analysis, though the vendor-published commit includes a working test case demonstrating the exact bypass payload.
XSS sanitizer bypass in typo3/html-sanitizer before 2.3.2 allows authenticated low-privileged users to inject unsanitized HTML by exploiting a parser divergence between the Masterminds HTML5 tokenizer and browser behavior for whitespace-variant closing tags such as </style\t>. The vulnerability is gated behind the non-default ALLOW_INSECURE_RAW_TEXT configuration flag, substantially limiting exposure. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Path traversal in the TYPO3 'Faceted Search' extension's file indexer exposes arbitrary server filesystem content to high-privileged backend users. Because the indexer does not normalize or canonicalize the configured directory path before use, a backend user holding the specific permission to edit indexer configurations can supply path traversal sequences to redirect indexing at sensitive locations outside the intended document root. The CVSS 4.0 score of 5.9 (Medium) reflects high confidentiality impact (VC:H) constrained by the requirement for high privileges (PR:H). No public exploit or CISA KEV listing exists at time of analysis.
Sensitive internal TYPO3 database content can be exfiltrated into the public search index via the Faceted Search extension's misconfigured additional_tables parameter. Backend users holding permission to edit indexer configurations can reference arbitrary internal database tables and fields - including those storing backend credentials, frontend user records, or other protected data - causing the search indexer to copy that data into the search index where it may be surfaced in search results or via API responses. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for high-privilege backend access (PR:H per CVSS 4.0), placing this firmly in insider-threat and privilege-misuse risk scenarios.
XML External Entity (XXE) injection in the OOXML file indexer of the TYPO3 'Faceted Search' extension (EXT:faceted_search) allows a high-privileged authenticated attacker to cause the server to disclose local file contents or perform outbound HTTP requests (SSRF), with retrieved data written to the search index. Exploitation requires placing a crafted XLSX or PPTX document into a directory processed by the indexer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Mass assignment in the TYPO3 'Frontend User Registration' extension allows unauthenticated remote attackers to assign arbitrary frontend user groups to accounts created or modified via the public registration and profile-edit flows. Because the extension neither restricts which user properties may be submitted nor enforces server-side access control on the group assignment field, an attacker registers or edits an account while injecting a privileged frontend user group identifier, immediately gaining access to content and functionality that would otherwise require elevated membership. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
CVE-2026-4202 is a security vulnerability (CVSS 2.3). Remediation should follow standard vulnerability management procedures.
Unsafe deserialization in TYPO3's mail transport extension permits arbitrary code execution when an attacker with write access to the configured spool directory supplies malicious serialized objects during transport failure handling. The vulnerability stems from inadequate class whitelisting during deserialization and requires local filesystem access to exploit. No patch is currently available.
The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. [CVSS 8.1 HIGH]
Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. [CVSS 6.4 MEDIUM]
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. [CVSS 6.5 MEDIUM]
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0-12.4.36 and 13.0.0-13.4.17 reduces entropy, allowing attackers to carry out brute‑force. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allows an attacker to redirect users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an enterprise content management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
TYPO3 is an enterprise content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 is an enterprise content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 is an enterprise content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Privilege escalation in TYPO3 CMS 14.2.0-14.3.6 allows backend administrators without system-maintainer privileges to schedule configuration commands (configuration:set, configuration:show, configuration:read) through the TYPO3 scheduler module, bypassing the role-based authorization that normally restricts these operations to the highest privilege tier. An attacker holding a backend administrator account can leverage this to silently elevate themselves to system-maintainer status or corrupt system configuration to trigger a denial of service. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cache-poisoning-based access control bypass in the Apache Solr for TYPO3 Enterprise Search extension allows anonymous visitors to read pages that should be protected by extendToSubpages-inherited frontend-group restrictions. The extension fails to isolate its forged access-restriction state during indexer sub-requests, writing empty frontend-group and subpage-inheritance flags into the shared TYPO3 rootline cache, where they persist and serve subsequent user requests without the original restrictions applied. No public exploit code has been identified at time of analysis, but the CVSS 4.0 score of 7.6 with combined high confidentiality and integrity impact reflects meaningful severity for any TYPO3 deployment relying on page-level inherited access controls.
PHP Object Injection in the Apache Solr for TYPO3 enterprise search extension allows authenticated low-privileged users to achieve arbitrary code execution on the server when user-generated content can reach indexed fields configured with SOLR_CLASSIFICATION, SOLR_MULTIVALUE, or SOLR_RELATION content object types. The extension's indexer passes multi-value field values rendered by the content object renderer directly to PHP's unserialize() function rather than a safe serialization format, creating a CWE-502 attack surface exploitable via PHP gadget chains. No public exploit code has been identified at time of analysis, though the vulnerability class is well-understood and commonly weaponized; the CVSS 4.0 score of 7.7 reflects the severe potential impact tempered by meaningful exploitation preconditions.
Server-Side Template Injection in TYPO3's Event Management and Registration extension allows authenticated backend editors to disclose sensitive application data or execute TypoScript content objects by supplying Fluid ViewHelper syntax in the email subject field. The flaw affects backend users with edit access to the event registration plugin or backend module - an insider-level privilege boundary that limits but does not eliminate risk, particularly in multi-tenant or agency-managed TYPO3 installations. No public exploit code or CISA KEV listing exists at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential impact if the precondition is met.
The femanager extension for TYPO3 CMS incorrectly accepts a regular user confirmation hash - obtainable by any visitor via the public resend-confirmation action - in place of the privileged admin confirmation token when processing account-approval requests. This allows a registrant whose account is pending administrator authorization to self-approve that account, fully bypassing the admin-approval gate. No public exploit code has been identified at time of analysis, but the attack is mechanically trivial given the public exposure of the prerequisite token; the CVSS 4.0 score of 8.3 reflects high confidentiality impact against the vulnerable system.
Insecure Direct Object Reference in the TYPO3 femanager extension exposes frontend user profile data - including name, email address, date of birth, and postal address - to any unauthenticated visitor who can reach the Detail or List plugin. The extension's user detail view accepts a caller-supplied user ID without validating that the requested record belongs to the configured or authenticated target, making horizontal privilege escalation trivial via ID enumeration. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Server-side template injection in the TYPO3 'Powermail' extension lets an anonymous user submit Fluid template syntax through any form field configured as the sender-name field, which the extension renders as raw template source. Because the value is passed unsanitized into a Fluid View, attackers can invoke arbitrary Fluid ViewHelpers to read server configuration, environment variables and application source, and in many deployments achieve remote code execution. The vendor (TYPO3, advisory TYPO3-EXT-SA-2026-022) reports active exploitation in the wild, and the flaw is unauthenticated (CVSS 4.0 base 9.5, PR:N).
SQL injection in the TYPO3 'Forms Export' backend extension allows a low-privileged authenticated backend user to inject arbitrary SQL through a URL parameter, yielding high-impact access to the underlying database (confidentiality, integrity, and availability). Exploitation is constrained to users with at least read access to the Forms Export backend module, limiting the attack surface to the TYPO3 administrative backend. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential database impact.
Remote code execution in the TYPO3 'HTML5 Video Player vs. Powermail' extension allows a remote, unauthenticated attacker to achieve arbitrary code execution on the server by supplying a crafted serialized value in an attacker-controlled cookie that is passed to PHP's unserialize(). The flaw is a classic PHP Object Injection (CWE-502) with full confidentiality, integrity, and availability impact and a CVSS 4.0 base score of 9.3. No public exploit identified at time of analysis, but the trivial attack requirements make weaponization straightforward.
Unauthenticated record tampering in the TYPO3 Telephone Directory extension allows any visitor who can identify an employee UID to overwrite that employee's data via a direct POST request, bypassing HMAC-based edit-link authorization entirely. The extension enforces HMAC validation only at the form-render step, leaving the persistence action unprotected under CWE-862 (Missing Authorization). With a CVSS 4.0 score of 8.7 and an attack profile of network-accessible, no-privilege, no-interaction, no public exploit has been identified at time of analysis, but the attack requires no authentication and minimal attacker capability.
Unauthenticated record takeover in the TYPO3 'Club Directory' extension allows any visitor to overwrite or force-publish arbitrary club records by supplying a known record UID in requests to the frontend edit, update, and activate actions. The extension resolves records directly from user-controlled input without performing any ownership or authorization check, making this a textbook CWE-862 (Missing Authorization) / IDOR vulnerability. No public exploit has been identified at time of analysis, but exploitation is trivially simple given the network-accessible attack surface, absence of authentication, and sequential nature of TYPO3 record UIDs.
Broken access control in the TYPO3 Industry Directory extension allows unauthenticated network visitors to overwrite company records they do not own. The frontend edit form is gated by a template-level visibility flag, but the server-side write controller performs no corresponding ownership verification, making the UI restriction trivially bypassable via direct HTTP submission using any publicly visible record identifier. No public exploit code or CISA KEV listing has been identified at time of analysis, but the absence of authentication requirements and low attack complexity make independent exploitation straightforward against any exposed deployment.
Missing server-side ownership verification in the TYPO3 Forum extension allows any unauthenticated visitor to overwrite the content of any forum topic. Because topic identifiers are enumerable from the public forum listing, an attacker needs no credentials, special access, or non-default configuration to target arbitrary topics. The CVSS 4.0 score of 8.8 reflects high integrity impact; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthorized organizer attribution in the TYPO3 Events 2 frontend management extension allows any authenticated organizer-role user to create events falsely attributed to another organizer's record by supplying a foreign organizer identifier in the event creation request. The flaw stems from a permission check that validates only the presence of any organizer role rather than verifying the submitting user's ownership of the specific organizer referenced in the request. No public exploit has been identified and this vulnerability is absent from CISA KEV; however, the CVSS 4.0 score of 7.1 reflects a high integrity impact on the vulnerable system driven by straightforward, low-privilege network exploitation with no additional attack requirements.
Cross-organizer event modification in the TYPO3 Events 2 extension allows any authenticated frontend event manager to tamper with events owned by other organizers. The frontend management update flow performs its authorization check against a different event identifier than the one the request ultimately modifies - a textbook CWE-639 IDOR mismatch - granting write access beyond the user's legitimate scope. No public exploit has been identified at time of analysis, but with a CVSS 4.0 score of 7.1 (VI:H) and only low-privilege authentication required (PR:L), the integrity risk is meaningful in any multi-organizer TYPO3 deployment.
Unauthenticated account takeover in the TYPO3 femanager extension 8.x allows a remote attacker to reset the password of and re-enable any existing frontend user account - including disabled or deleted ones - by exploiting an invitation controller that continues processing after issuing a redirect on invalid input. No prior authentication or user interaction is required. No public exploit code or active exploitation has been identified at time of analysis, but the impact is severe: full account takeover of arbitrary frontend users in any TYPO3 installation running femanager 8.x.
Broken referrer enforcement in TYPO3 CMS backend and Install Tool allows an attacker with JavaScript execution capability on any of the site's own domains to invoke privileged backend routes and Install Tool endpoints using an authenticated victim's session. The regression was introduced in TYPO3 13.0.0 when both the backend and Install Tool were moved to serve from the site root entry point rather than the dedicated `/typo3/` subdirectory, causing the `ReferrerEnforcer` to accept any same-origin Referer header as legitimate backend traffic. Affected versions are TYPO3 CMS 13.0.0-13.4.33 and 14.0.0-14.3.5; no public exploit code has been identified at time of analysis.
Remote code execution in the TYPO3 'Content Element Selector' extension allows unauthenticated attackers to execute arbitrary PHP code by sending a crafted cookie that the extension feeds directly into PHP's unserialize(). The flaw (CWE-502, CVSS 4.0 score 9.2) is exploitable only on installations where a content element is configured with 'Persistent Mode: Static'. No public exploit identified at time of analysis, though the deserialization pattern is well-understood and typically rapid to weaponize.
SQL injection in the TYPO3 'address_list' extension's AddressRepository::getSqlQuery() method allows remote attackers to manipulate database queries when the method is called with untrusted input. The flaw is latent - the vulnerable method is not invoked anywhere within the extension itself, so default installations are not exposed, but custom or third-party extensions that reuse this method become injection sinks. No public exploit identified at time of analysis, and no EPSS or KEV signal accompanies the advisory.
SQL injection in the TYPO3 'news' extension allows unauthenticated remote attackers to inject arbitrary SQL through a URL parameter on pages that render the 'Date Menu of news articles' plugin. The flaw stems from missing sanitization of user input before it reaches a database query, and exposure is limited to sites that both use the affected plugin and have not enabled the TypoScript/plugin setting disableOverrideDemand. No public exploit identified at time of analysis.
Remote code execution in the TYPO3 Crawler extension occurs when the X-T3Crawler-Meta response header from a crawled URL is passed unchecked to PHP's unserialize(), enabling arbitrary PHP object injection. Exploitation requires a high-privileged administrator to configure a crawler-enabled page and a Scheduler task pointing at an attacker-controlled endpoint, so while impact is full RCE on the TYPO3 host, it is gated by an unusual combination of admin access, user interaction, and externally reachable malicious URLs. No public exploit identified at time of analysis and no CISA KEV listing.
TYPO3 CMS 14.2.0 stores backend user passwords in cleartext within database fields (uc, user_settings) when passwords are changed through the user settings module. Remote attackers with database read access or exploiting SQL injection vulnerabilities can retrieve plaintext credentials for backend administrator accounts. Vendor patch available via GitHub commit 9a6e913f. No active exploitation confirmed at time of analysis, though high CVSS subsequent system impact scores (SC:H/SI:H/SA:H) indicate potential for privilege escalation if database is compromised.
CVE-2026-4208 is a security vulnerability (CVSS 7.7). High severity vulnerability requiring prompt remediation.
Arbitrary PHP code execution in TYPO3 CMS versions 10.0.0 through 14.0.1 through unsafe deserialization of mail spool files, allowing local attackers with write access to the spool directory to execute malicious code when the mailer:spool:send command is executed. Affected versions span multiple release lines including 10.x, 11.x, 12.x, 13.x, and 14.x, requiring immediate patching to prevent web server compromise.
Unauthorized information disclosure in TYPO3 CMS backend localization wizard exposes records and content elements outside a low-privileged user's permitted access scope. Multiple AJAX endpoints in the PHP LocalizationController - used to drive the multi-step translation wizard - accept arbitrary record UIDs without performing authorization checks, allowing any authenticated backend user to query metadata about content they should not be able to see. All actively maintained TYPO3 major branches (10.x through 14.x) are affected, vendor patches are available, and no public exploit or active exploitation has been identified at time of analysis.
Frontend detail-view document lookup in the Apache Solr for TYPO3 Enterprise Search extension bypasses both the siteHash isolation filter and frontend user access controls, allowing retrieval of Solr-indexed documents outside normal authorization constraints. An unauthenticated visitor who obtains or guesses a valid Solr document ID can access content restricted to specific sites or authenticated frontend users by querying the detail-view endpoint directly, circumventing the access controls enforced on the regular search path. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects that exploitation depends on obtaining valid document IDs.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.
Unauthorized database field disclosure in the TYPO3 "Modules" extension allows any authenticated low-privileged backend user to read arbitrary database field values - including backend and frontend user password hashes - by supplying user-controlled table, field, and record parameters to an unprotected AJAX inline editing endpoint. The authorization check protecting which fields a given user may view or modify is entirely absent from this endpoint, meaning any backend session holder with module access can query sensitive records regardless of their configured permissions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the attack requires only a valid TYPO3 backend login, making it a meaningful insider privilege-escalation risk in multi-user installations.
Unauthorized event disclosure in the TYPO3 "Event Management and Registration" extension allows unauthenticated remote users to view hidden or time-restricted events by supplying a demand-override query parameter that the extension fails to validate against its own enable-field restrictions. The vulnerability (CWE-862, Missing Authorization) is exploitable against any deployment where the `disableOverrideDemand` plugin setting is not explicitly activated - making non-hardened installs vulnerable by default. No public exploit code has been identified at time of analysis, and CVSS 4.0 scores this at 6.3 Medium with low confidentiality impact and no integrity or availability consequence.
Insufficient JWT expiration validation in the TYPO3 'Syssy - TYPO3 Monitoring & Security Checks' extension allows an attacker already in possession of a valid SYSSY project API key to authenticate using an expired token, bypassing the intended session time boundary (CWE-613). The limited confidentiality and integrity impact (VC:L/VI:L per the CVSS 4.0 vector) reflects access to monitoring and security check data rather than full system compromise. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code has been identified at time of analysis.
Cleartext transmission of TYPO3 system information occurs in the Syssy - TYPO3 Monitoring & Security Checks extension when OpenSSL is absent on the hosting server, exposing potentially sensitive configuration and system data to network interception (CWE-319). All tracked versions of the extension are affected per CPE data, though exploitation is constrained by the dual requirement of OpenSSL being unavailable and the attacker already possessing the SYSSY project's API key. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 score of 5.3 reflects the medium-severity, partially-authenticated nature of the flaw.
Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.
Path traversal in the TYPO3 Mask extension allows authenticated backend users with Mask module access to create or delete arbitrary .html files outside the configured template directory. The flaw stems from the extension's failure to validate client-supplied template element keys before using them to construct filesystem paths for saving and deleting Mask template files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity impact is concrete - an attacker can overwrite or remove .html files anywhere the TYPO3 web process has write access.
HTML serialization in typo3/html-sanitizer before version 2.3.2 fails to encode namespace attributes (xmlns:*), allowing an authenticated low-privilege attacker to inject unsanitized XSS payloads that execute in victims' browsers. The vulnerability bypasses the library's core XSS prevention purpose: crafted namespace attribute values containing raw HTML (e.g., onerror handlers) survive the sanitizer and render as executable markup. No public exploit has been independently identified at time of analysis, though the vendor-published commit includes a working test case demonstrating the exact bypass payload.
XSS sanitizer bypass in typo3/html-sanitizer before 2.3.2 allows authenticated low-privileged users to inject unsanitized HTML by exploiting a parser divergence between the Masterminds HTML5 tokenizer and browser behavior for whitespace-variant closing tags such as </style\t>. The vulnerability is gated behind the non-default ALLOW_INSECURE_RAW_TEXT configuration flag, substantially limiting exposure. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Path traversal in the TYPO3 'Faceted Search' extension's file indexer exposes arbitrary server filesystem content to high-privileged backend users. Because the indexer does not normalize or canonicalize the configured directory path before use, a backend user holding the specific permission to edit indexer configurations can supply path traversal sequences to redirect indexing at sensitive locations outside the intended document root. The CVSS 4.0 score of 5.9 (Medium) reflects high confidentiality impact (VC:H) constrained by the requirement for high privileges (PR:H). No public exploit or CISA KEV listing exists at time of analysis.
Sensitive internal TYPO3 database content can be exfiltrated into the public search index via the Faceted Search extension's misconfigured additional_tables parameter. Backend users holding permission to edit indexer configurations can reference arbitrary internal database tables and fields - including those storing backend credentials, frontend user records, or other protected data - causing the search indexer to copy that data into the search index where it may be surfaced in search results or via API responses. No public exploit has been identified at time of analysis, and exploitation is constrained by the requirement for high-privilege backend access (PR:H per CVSS 4.0), placing this firmly in insider-threat and privilege-misuse risk scenarios.
XML External Entity (XXE) injection in the OOXML file indexer of the TYPO3 'Faceted Search' extension (EXT:faceted_search) allows a high-privileged authenticated attacker to cause the server to disclose local file contents or perform outbound HTTP requests (SSRF), with retrieved data written to the search index. Exploitation requires placing a crafted XLSX or PPTX document into a directory processed by the indexer. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Mass assignment in the TYPO3 'Frontend User Registration' extension allows unauthenticated remote attackers to assign arbitrary frontend user groups to accounts created or modified via the public registration and profile-edit flows. Because the extension neither restricts which user properties may be submitted nor enforces server-side access control on the group assignment field, an attacker registers or edits an account while injecting a privileged frontend user group identifier, immediately gaining access to content and functionality that would otherwise require elevated membership. No public exploit is identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
CVE-2026-4202 is a security vulnerability (CVSS 2.3). Remediation should follow standard vulnerability management procedures.
Unsafe deserialization in TYPO3's mail transport extension permits arbitrary code execution when an attacker with write access to the configured spool directory supplies malicious serialized objects during transport failure handling. The vulnerability stems from inadequate class whitelisting during deserialization and requires local filesystem access to exploit. No patch is currently available.
The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. [CVSS 8.1 HIGH]
Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. [CVSS 6.4 MEDIUM]
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. [CVSS 6.5 MEDIUM]
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0-12.4.36 and 13.0.0-13.4.17 reduces entropy, allowing attackers to carry out brute‑force. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allows an attacker to redirect users. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
TYPO3 is an open source, PHP based web content management system. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated data saved in the. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
TYPO3 is a free and open source Content Management Framework. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an enterprise content management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
TYPO3 is an enterprise content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 is an enterprise content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 is an enterprise content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
TYPO3 is an open source PHP based web content management system released under the GNU GPL. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and values. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
TYPO3 is an open source PHP based web content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.