TYPO3

Latest CVEs · RSS

• CVE-2026-109162 2026-10-13 · CVSS 6.3
  Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ inst
• CVE-2026-77132 2026-09-08 · CVSS 5.3
  It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low
• CVE-2026-85400 2026-09-08 · CVSS 7.5
  Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show comma
• CVE-2026-56092 2026-08-25 · CVSS 7.6
  The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persiste
• CVE-2026-56093 2026-08-25 · CVSS 6.3
  The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search
• CVE-2026-56094 2026-08-25 · CVSS 6.3
  The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and
• CVE-2026-56095 2026-08-25 · CVSS 7.7
  The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data fo
• CVE-2026-56096 2026-08-25 · CVSS 6.3
  The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors a
• CVE-2026-77127 2026-08-25 · CVSS 6.0
  The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privile
• CVE-2026-77128 2026-08-25 · CVSS 6.3
  The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to
• CVE-2026-77129 2026-08-25 · CVSS 7.7
  The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to t
• CVE-2026-77130 2026-08-25 · CVSS 5.3
  The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with
• CVE-2026-77131 2026-08-25 · CVSS 5.3
  When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the att
• CVE-2026-77133 2026-08-25 · CVSS 6.0
  The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field c
• CVE-2026-77134 2026-08-25 · CVSS 8.3
  The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable
• CVE-2026-77135 2026-08-25 · CVSS 8.2
  The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to th
• CVE-2026-77136 2026-08-25 · CVSS 9.5
  The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, wit
• CVE-2026-77137 2026-08-25 · CVSS 7.7
  The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL thr
• CVE-2026-77138 2026-08-25 · CVSS 9.3
  The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacke
• CVE-2026-77139 2026-08-25 · CVSS 6.0
  The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authe
• CVE-2026-77140 2026-08-25 · CVSS 8.7
  The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An
• CVE-2026-77141 2026-08-25 · CVSS 8.8
  The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no owners
• CVE-2026-77142 2026-08-25 · CVSS 8.8
  The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, b
• CVE-2026-77143 2026-08-25 · CVSS 8.8
  The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows t
• CVE-2026-77144 2026-08-25 · CVSS 7.1
  The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own