typo3/cms-core vulnerabilities
TYPO3 CMS Core
- Registry
- Composer
- Latest
- 14.3.10
- License
- GPL-2.0-or-later
128 known advisories
The latest version, 14.3.10, is not affected by any of them. Projects on older versions may be.
composer require typo3/cms-core:^14.3.10Security advisories for typo3/cms-core
TYPO3 CMS - Broken Access Control in Backend and Install Tool
- Affected
- >=14.0.0 <14.3.6
- Fixed in
- 14.3.6
TYPO3 CMS has Broken Access Control in its Form Framework
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS has Broken Access Control in the Recycler Module
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS: Destructive Actions on File Mount Folders
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
- Affected
- >=14.0.0 <14.3.3
- Fixed in
- 14.3.3
TYPO3 CMS has Broken Access Control in its DataHandler
- Affected
- >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 13.4.31, 14.3.3
TYPO3 CMS has Broken Access Control in its Form Framework
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS has Broken Access Control in its Media Module
- Affected
- >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS has Insecure Deserialization via Core API
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS has Broken Access Control in Backend API
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS: Broken Access Control in Media Module
- Affected
- <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
TYPO3 CMS has Cross-Site Scripting in Indexed Search
- Affected
- >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
- Fixed in
- 13.4.31, 14.3.3
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
- Affected
- >=14.0.0 <14.0.2 · >=13.0.0 <13.4.23 · >=12.0.0 <12.4.41 · >=11.0.0 <11.5.49 · >=10.0.0 <10.4.55
- Fixed in
- 10.4.55, 11.5.49, 12.4.41, 13.4.23, 14.0.2
TYPO3 CMS exposes sensitive information in an error message
- Affected
- >=9.0.0 <12.4.37 · >=10.0.0 <12.4.37 · >=11.0.0 <12.4.37 · >=12.0.0 <12.4.37 · >=13.0.0 <13.4.18
- Fixed in
- 12.4.37, 13.4.18
TYPO3 CMS has an open‑redirect vulnerability
- Affected
- >=9.0.0 <12.4.37 · >=10.0.0 <12.4.37 · >=11.0.0 <12.4.37 · >=12.0.0 <12.4.37 · >=13.0.0 <13.4.18
- Fixed in
- 12.4.37, 13.4.18
TYPO3 CMS uses insufficient entropy when generating passwords
- Affected
- >=12.0.0 <12.4.37 · >=13.0.0 <13.4.18
- Fixed in
- 12.4.37, 13.4.18
TYPO3 Allows Privilege Escalation to System Maintainer
- Affected
- >=10.4.0 <10.4.50 · >=11.0.0 <11.5.44 · >=12.0.0 <12.4.31 · >=13.0.0 <13.4.12
- Fixed in
- 10.4.50, 11.5.44, 12.4.31, 13.4.12
TYPO3 Allows Unrestricted File Upload in File Abstraction Layer
- Affected
- >=9.0.0 <9.5.51 · >=10.0.0 <10.4.50 · >=11.0.0 <11.5.44 · >=12.0.0 <12.4.31 · >=13.0.0 <13.4.12
- Fixed in
- 9.5.51, 10.4.50, 11.5.44, 12.4.31, 13.4.12
TYPO3 Unverified Password Change for Backend Users
- Affected
- >=9.0.0 <9.5.51 · >=10.0.0 <10.4.50 · >=11.0.0 <11.5.44 · >=12.0.0 <12.4.31 · >=13.0.0 <13.4.12
- Fixed in
- 9.5.51, 10.4.50, 11.5.44, 12.4.31, 13.4.12
TYPO3 Allows Information Disclosure via DBAL Restriction Handling
- Affected
- >=9.0.0 <9.5.51 · >=10.0.0 <10.4.50 · >=11.0.0 <11.5.44 · >=12.0.0 <12.4.31 · >=13.0.0 <13.4.12
- Fixed in
- 9.5.51, 10.4.50, 11.5.44, 12.4.31, 13.4.12
TYPO3 Potential Open Redirect via Parsing Differences
- Affected
- >=9.0.0 <9.5.49 · >=10.0.0 <10.4.48 · >=11.0.0 <11.5.42 · >=12.0.0 <12.4.25 · >=13.0.0 <13.4.3
- Fixed in
- 9.5.49, 10.4.48, 11.5.42, 12.4.25, 13.4.3
TYPO3 Possible Insecure Deserialization in Extbase Request Handling
- Affected
- >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12
TYPO3 Cross-Site Scripting in Filelist Module
- Affected
- >=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.1
TYPO3 Cross-Site Scripting in Link Handling
- Affected
- >=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.1
TYPO3 Cross-Site Scripting in Form Framework validation handling
- Affected
- >=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.1
TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
TYPO3 Broken Access Control in Import Module
- Affected
- >=9.3.0 <9.5.8
- Fixed in
- 9.5.8
TYPO3 Security Misconfiguration in Frontend Session Handling
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
TYPO3 Information Disclosure in Backend User Interface
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
TYPO3 Information Disclosure in User Authentication
- Affected
- >=9.0.0 <9.5.6
- Fixed in
- 9.5.6
TYPO3 Disclosure of Information about Installed Extensions
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 Information Disclosure in Page Tree
- Affected
- >=9.0.0 <9.5.6
- Fixed in
- 9.5.6
TYPO3 Security Misconfiguration in User Session Handling
- Affected
- >=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
- Fixed in
- 8.7.25, 9.5.6
TYPO3 Cross-Site Scripting in Form Framework
- Affected
- >=8.5.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 Cross-Site Scripting in Language Pack Handling
- Affected
- >=9.2.0 <9.5.4
- Fixed in
- 9.5.4
TYPO3 Arbitrary Code Execution via File List Module
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 Broken Access Control in Localization Handling
- Affected
- >=8.0.0 <8.7.23
- Fixed in
- 8.7.23
TYPO3 Security Misconfiguration for Backend User Accounts
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 Denial of Service in Frontend Record Registration
- Affected
- >=8.0.0 <8.7.21 · >=7.0.0 <7.6.32
- Fixed in
- 7.6.32, 8.7.21
TYPO3 Denial of Service in Online Media Asset Handling
- Affected
- >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.0.0 <7.6.32
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Information Disclosure in Install Tool
- Affected
- >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.0.0 <7.6.32
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Security Misconfiguration in Install Tool Cookie
- Affected
- >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.0.0 <7.6.32
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Cross-Site Scripting in Frontend User Login
- Affected
- >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.1.0 <7.6.32
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Cross-Site Scripting in Backend Modal Component
- Affected
- >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2 · >=7.1.0 <7.6.32
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 CMS Insecure Deserialization
- Affected
- >=8.5.0 <8.7.17 · >=9.0.0 <9.3.1
- Fixed in
- 8.7.17, 9.3.1
TYPO3 Cross-Site Scripting in Online Media Asset Rendering
- Affected
- >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 8.7.21, 9.5.2
TYPO3 CMS Privilege Escalation and SQL Injection
- Affected
- >=8.5.0 <8.7.17 · >=9.0.0 <9.3.2
- Fixed in
- 8.7.17, 9.3.2
TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution
- Affected
- >=8.0.0 <8.7.17 · >=9.0.0 <9.3.2 · >=7.0.0 <7.6.30
- Fixed in
- 7.6.30, 8.7.17, 9.3.2
TYPO3 CMS Authentication Bypass vulnerability
- Affected
- >=8.0.0 <8.7.17 · >=9.0.0 <9.3.2 · >=7.0.0 <7.6.30
- Fixed in
- 7.6.30, 8.7.17, 9.3.2
TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController
- Affected
- >=9.0.0 <9.5.48 · >=10.0.0 <10.4.45 · >=11.0.0 <11.5.37 · >=12.0.0 <12.4.15 · >=13.0.0 <13.1.1
- Fixed in
- 9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1
TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController
- Affected
- >=9.0.0 <9.5.48 · >=10.0.0 <10.4.45 · >=11.0.0 <11.5.37 · >=12.0.0 <12.4.15 · >=13.0.0 <13.1.1
- Fixed in
- 9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1
TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
- Affected
- >=9.0.0 <9.5.48 · >=10.0.0 <10.4.45 · >=11.0.0 <11.5.37 · >=12.0.0 <12.4.15 · >=13.0.0 <13.1.1
- Fixed in
- 9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1
TYPO3 vulnerable to an HTML Injection in the History Module
- Affected
- >=13.0.0 <13.1.1
- Fixed in
- 13.1.1
TYPO3 Install Tool vulnerable to Code Execution
- Affected
- >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
- Fixed in
- 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
Path Traversal in TYPO3 File Abstraction Layer Storages
- Affected
- >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
- Fixed in
- 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
- Affected
- >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
- Fixed in
- 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme
- Affected
- >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
- Fixed in
- 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key
- Affected
- >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
- Fixed in
- 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords
- Affected
- >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
- Fixed in
- 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
TYPO3 vulnerable to Weak Authentication in Session Handling
- Affected
- >=8.0.0 <8.7.55 · >=9.0.0 <9.5.44 · >=10.0.0 <10.4.41 · >=11.0.0 <11.5.33 · >=12.0.0 <12.4.8
- Fixed in
- 8.7.55, 9.5.44, 10.4.41, 11.5.33, 12.4.8
Information Disclosure due to Out-of-scope Site Resolution
- Affected
- >=9.4.0 <9.5.42 · >=10.0.0 <10.4.39 · >=11.0.0 <11.5.30 · >=12.0.0 <12.4.4
- Fixed in
- 9.5.42, 10.4.39, 11.5.30, 12.4.4
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
- Affected
- >=12.0.0 <12.2.0 · >=11.0.0 <11.5.23 · >=10.0.0 <10.4.36 · >=9.0.0 <9.5.40 · >=8.7.0 <8.7.51
- Fixed in
- 8.7.51, 9.5.40, 10.4.36, 11.5.23, 12.2.0
TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration
- Affected
- >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 9.5.38, 10.4.33, 11.5.20, 12.1.1
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
- Affected
- >=8.0.0 <8.7.49 · >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 8.7.49, 9.5.38, 10.4.33, 11.5.20, 12.1.1
TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset
- Affected
- >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 10.4.33, 11.5.20, 12.1.1
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login
- Affected
- <8.7.49 · >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 8.7.49, 9.5.38, 10.4.33, 11.5.20, 12.1.1
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
- Affected
- >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20
- Fixed in
- 9.5.38, 10.4.33, 11.5.20
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
- Affected
- >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 10.4.32, 11.5.16
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
- Affected
- >=11.4.0 <11.5.16
- Fixed in
- 11.5.16
TYPO3 CMS vulnerable to User Enumeration via Response Timing
- Affected
- >=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
TYPO3 CMS missing check for expiration time of password reset token for backend users
- Affected
- >=10.4.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 10.4.32, 11.5.16
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController
- Affected
- >=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper
- Affected
- >=10.3.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 10.4.32, 11.5.16
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
- Affected
- >=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
Insufficient Session Expiration in TYPO3's Admin Tool
- Affected
- >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 9.5.35, 10.4.29, 11.5.11
Cross-Site Scripting in TYPO3's Frontend Login Mailer
- Affected
- >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 9.5.35, 10.4.29, 11.5.11
Cross-Site Scripting in TYPO3's Form Framework
- Affected
- >=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 8.7.47, 9.5.35, 10.4.29, 11.5.11
Insertion of Sensitive Information into Log File in typo3/cms-core
- Affected
- >=7.0.0 <7.6.57 · >=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
Information Disclosure via Export Module
- Affected
- >=7.0.0 <7.6.57 · >=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
TYPO3 Vulnerable to Insecure Deserialization
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
Typo3 Cross-Site Scripting in Link Handling
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
TYPO3 Image Processing susceptible to Code Execution
- Affected
- >=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
- Fixed in
- 8.7.25, 9.5.6
TYPO3 SQL Injection in low-level Query Generator
- Affected
- >=8.0 <8.7.30 · >=9.0 <9.5.12 · >=10.0 <10.2.2
- Fixed in
- 8.7.30, 9.5.12, 10.2.2
TYPO3 Insecure Deserialization in Query Generator & Query View
- Affected
- >=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.1
TYPO3 Directory Traversal on ZIP extraction
- Affected
- >=10.0.0 <10.2.2 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.2
TYPO3 SQL injection vulnerability in the Extbase Framework
- Affected
- >=4.5.0 <4.5.24 · >=4.6.0 <4.6.17 · >=4.7.0 <4.7.9 · >=6.0.0 <6.0.3
- Fixed in
- 4.5.24, 4.6.17, 4.7.9, 6.0.3
TYPO3 Open redirect vulnerability in the Access tracking mechanism
- Affected
- >=4.5.0 <4.5.24 · >=4.6.0 <4.6.17 · >=4.7.0 <4.7.9 · >=6.0.0 <6.0.3
- Fixed in
- 4.5.24, 4.6.17, 4.7.9, 6.0.3
TYPO3 is vulnerable to Mass Assignment in the Extension table administration library
- Affected
- >=4.5.0 <4.5.31 · >=4.6.0 <4.7.16 · >=6.0.0 <6.0.11
- Fixed in
- 4.5.31, 4.7.16, 6.0.11
TYPO3 Improper Access Control vulnerability
- Affected
- >=4.5.0 <4.5.31 · >=4.7.0 <4.7.16 · >=6.0.0 <6.0.11 · >=6.1.0 <6.1.6
- Fixed in
- 4.5.31, 4.7.16, 6.0.11, 6.1.6
TYPO3 Improper Access Management in the File Abstraction Layer
- Affected
- >=6.0 <6.0.9 · >=6.1 <6.1.4
- Fixed in
- 6.0.9, 6.1.4
TYPO3 Sensitive Information Disclosure via escapeStrForLike method
- Affected
- >=4.2.0 <4.2.16 · >=4.3.0 <4.3.9 · >=4.4.0 <4.4.5
- Fixed in
- 4.2.16, 4.3.9, 4.4.5
TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework
- Affected
- >=4.5.0 <4.5.31 · >=4.7.0 <4.7.16 · >=6.1.0 <6.1.6 · >=6.0.0 <6.0.11
- Fixed in
- 4.5.31, 4.7.16, 6.0.11, 6.1.6
TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module
- Affected
- >=6.0 <6.0.12 · >=6.1 <6.1.7
- Fixed in
- 6.0.12, 6.1.7
TYPO3 API function vulnerable to Cross-site Scripting
- Affected
- <=4.0.13 · >=4.1.0 <4.1.13 · >=4.2.0 <4.2.10 · >=4.3alpha1 <4.3beta2
- Fixed in
- 4.1.13, 4.2.10, 4.3beta2
TYPO3 Unrestricted File Upload vulnerability
- Affected
- >=4.0.0 <4.0.9 · >=4.1.0 <4.1.7 · >=4.2.0 <4.2.1
- Fixed in
- 4.0.9, 4.1.7, 4.2.1
TYPO3 is vulnerable to Information Disclosure in the HTML mailing API
- Affected
- <4.2.13 · >=4.3 <4.3.4 · >=4.4 <4.4.1
- Fixed in
- 4.2.13, 4.3.4, 4.4.1
Cross-Site-Request-Forgery in Backend
- Affected
- >=11.2.0 <11.5.0
- Fixed in
- 11.5.0
HTTP Host Header Injection
- Affected
- >=11.0.0 <11.5.0
- Fixed in
- 11.5.0
Cross-Site Scripting via Rich-Text Content
- Affected
- >=7.0.0 <7.6.53 · >=8.0.0 <8.7.42 · >=10.0.0 <10.4.19 · >=11.0.0 <11.3.2 · >=9.0.0 <9.5.29
- Fixed in
- 7.6.53, 8.7.42, 9.5.29, 10.4.19, 11.3.2
Information Disclosure in User Authentication
- Affected
- >=7.0.0 <7.6.52 · >=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
- Fixed in
- 7.6.52, 8.7.41, 9.5.28, 10.4.18, 11.3.1
Cross-Site Scripting in Backend Grid View
- Affected
- >=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
- Fixed in
- 8.7.41, 9.5.28, 10.4.18, 11.3.1
Cross-Site Scripting in Query Generator & Query View
- Affected
- >=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
- Fixed in
- 8.7.41, 9.5.28, 10.4.18, 11.3.1
Cross-Site Scripting in Page Preview
- Affected
- >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
- Fixed in
- 9.5.28, 10.4.18, 11.3.1
Cross-Site Scripting in Content Preview (CType menu)
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Denial of Service in Page Error Handling
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1
- Fixed in
- 10.4.14, 11.1.1
Broken Access Control in Form Framework
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Unrestricted File Upload in Form Framework
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Cross-Site Scripting in Content Preview
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1
- Fixed in
- 10.4.14, 11.1.1
Cleartext storage of session identifier
- Affected
- >=6.2.0 <6.2.57 · >=7.0.0 <7.6.51 · >=8.0.0 <8.7.40 · >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1
Open Redirection in Login Handling
- Affected
- >=6.2.0 <6.2.57 · >=7.0.0 <7.6.51 · >=8.0.0 <8.7.40 · >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1
Cross-Site Scripting in Fluid view helpers
- Affected
- >=9.0.0 <9.5.23 · >=10.0.0 <10.4.10 · >=8.7.0 <8.7.38
- Fixed in
- 8.7.38, 9.5.23, 10.4.10
XML External Entity in Dashboard Widget
- Affected
- >=10.0.0 <10.4.10
- Fixed in
- 10.4.10
Cleartext storage of session identifier
- Affected
- >=9.0.0 <9.5.23 · >=10.0.0 <10.4.10 · >=8.7.0 <8.7.38
- Fixed in
- 8.7.38, 9.5.23, 10.4.10
Cross-Site Scripting in ternary conditional operator
- Affected
- >=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
- Fixed in
- 8.7.25, 9.5.6
Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
- Affected
- >=9.0.0 <9.5.20 · >=10.0.0 <10.4.6
- Fixed in
- 9.5.20, 10.4.6
Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
- Affected
- >=9.0.0 <9.5.20 · >=10.0.0 <10.4.6
- Fixed in
- 9.5.20, 10.4.6
Backend Same-Site Request Forgery in TYPO3 CMS
- Affected
- >=9.0.0 <9.5.17 · >=10.0.0 <10.4.2
- Fixed in
- 9.5.17, 10.4.2
Insecure Deserialization in Backend User Settings in TYPO3 CMS
- Affected
- >=9.0.0 <9.5.17 · >=10.0.0 <10.4.2
- Fixed in
- 9.5.17, 10.4.2
Class destructors causing side-effects when being unserialized in TYPO3 CMS
- Affected
- >=9.0.0 <9.5.17 · >=10.0.0 <10.4.2
- Fixed in
- 9.5.17, 10.4.2
Cross-Site Scripting in TYPO3 CMS Link Handling
- Affected
- >=10.0.0 <10.4.2 · >=9.0.0 <9.5.17
- Fixed in
- 9.5.17, 10.4.2
Cross-Site Scripting in TYPO3 CMS Form Engine
- Affected
- >=9.0.0 <9.5.17 · >=10.0.0 <10.4.2
- Fixed in
- 9.5.17, 10.4.2
Information Disclosure in Password Reset
- Affected
- >=10.0.0 <10.4.2
- Fixed in
- 10.4.2
Deserialization of untrusted data in Symfony
- Affected
- >=9.0.0 <9.5.8
- Fixed in
- 9.5.8
Ckeditor XSS Vulnerability
- Affected
- >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 8.7.21, 9.5.2
Bootstrap Cross-site Scripting vulnerability
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
Which of your client projects still run an old typo3/cms-core?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.