Is typo3/cms-core 11.3 vulnerable?

Composer · 4 releases from 11.3.0 to 11.3.3 · latest typo3/cms-core is 14.3.10 · checked 2 Nov 2026

Yes: 48 known advisories

Yes. typo3/cms-core 11.3.3, the last 11.3 release, is affected by 48 known security advisories (10 high, 34 medium, 4 low), including CVE-2026-11607, CVE-2026-47343, CVE-2026-47346. 5 more affect earlier 11.3.x releases. Upgrade to 12.4.37 or later to fix all of them.

Upgrade with:composer require typo3/cms-core:^12.4.37

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Advisories affecting typo3/cms-core 11.3.3

  • HighCVE-2026-11607GHSA-pjpj-v387-x4vq12 Jun 2026

    TYPO3 CMS has Broken Access Control in its Form Framework

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47349GHSA-f34x-rx2w-7pm312 Jun 2026

    TYPO3 CMS has Broken Access Control in the Recycler Module

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47347GHSA-3p42-w5ch-gg4212 Jun 2026

    TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • HighCVE-2026-47343GHSA-3v8v-4wg6-r7qh12 Jun 2026

    TYPO3 CMS: Destructive Actions on File Mount Folders

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • HighCVE-2026-47346GHSA-hwvq-2w67-rvxp12 Jun 2026

    TYPO3 CMS has Broken Access Control in its Form Framework

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • HighCVE-2026-49742GHSA-chm7-4vch-h8vr12 Jun 2026

    TYPO3 CMS has Broken Access Control in its Media Module

    Affected
    >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-49740GHSA-c78m-c52x-jgwp12 Jun 2026

    TYPO3 CMS has Insecure Deserialization via Core API

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • LowCVE-2026-49738GHSA-jf56-v8jc-jcc512 Jun 2026

    TYPO3 CMS has Broken Access Control in its File Abstraction Layer

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47352GHSA-2j54-93q2-3hjq12 Jun 2026

    TYPO3 CMS has Broken Access Control in Backend API

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47351GHSA-q93m-25xv-94hh12 Jun 2026

    TYPO3 CMS: Broken Access Control in Media Module

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-0859GHSA-7vp9-x248-9vr913 Jan 2026

    TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

    Affected
    >=14.0.0 <14.0.2 · >=13.0.0 <13.4.23 · >=12.0.0 <12.4.41 · >=11.0.0 <11.5.49 · >=10.0.0 <10.4.55
    Fixed in
    10.4.55, 11.5.49, 12.4.41, 13.4.23, 14.0.2
  • MediumCVE-2025-59016GHSA-cvm2-5f78-g9m89 Sept 2025

    TYPO3 CMS exposes sensitive information in an error message

    Affected
    >=9.0.0 <12.4.37 · >=10.0.0 <12.4.37 · >=11.0.0 <12.4.37 · >=12.0.0 <12.4.37 · >=13.0.0 <13.4.18
    Fixed in
    12.4.37, 13.4.18
  • MediumCVE-2025-59013GHSA-72jf-5fg5-3cw39 Sept 2025

    TYPO3 CMS has an open‑redirect vulnerability

    Affected
    >=9.0.0 <12.4.37 · >=10.0.0 <12.4.37 · >=11.0.0 <12.4.37 · >=12.0.0 <12.4.37 · >=13.0.0 <13.4.18
    Fixed in
    12.4.37, 13.4.18
  • HighCVE-2025-47940GHSA-6frx-j292-c84420 May 2025

    TYPO3 Allows Privilege Escalation to System Maintainer

    Affected
    >=10.4.0 <10.4.50 · >=11.0.0 <11.5.44 · >=12.0.0 <12.4.31 · >=13.0.0 <13.4.12
    Fixed in
    10.4.50, 11.5.44, 12.4.31, 13.4.12
  • MediumCVE-2025-47939GHSA-9hq9-cr36-4wpj20 May 2025

    TYPO3 Allows Unrestricted File Upload in File Abstraction Layer

    Affected
    >=9.0.0 <9.5.51 · >=10.0.0 <10.4.50 · >=11.0.0 <11.5.44 · >=12.0.0 <12.4.31 · >=13.0.0 <13.4.12
    Fixed in
    9.5.51, 10.4.50, 11.5.44, 12.4.31, 13.4.12
  • LowCVE-2025-47938GHSA-3jrg-97f3-rqh920 May 2025

    TYPO3 Unverified Password Change for Backend Users

    Affected
    >=9.0.0 <9.5.51 · >=10.0.0 <10.4.50 · >=11.0.0 <11.5.44 · >=12.0.0 <12.4.31 · >=13.0.0 <13.4.12
    Fixed in
    9.5.51, 10.4.50, 11.5.44, 12.4.31, 13.4.12
  • LowCVE-2025-47937GHSA-x8pv-fgxp-8v3x20 May 2025

    TYPO3 Allows Information Disclosure via DBAL Restriction Handling

    Affected
    >=9.0.0 <9.5.51 · >=10.0.0 <10.4.50 · >=11.0.0 <11.5.44 · >=12.0.0 <12.4.31 · >=13.0.0 <13.4.12
    Fixed in
    9.5.51, 10.4.50, 11.5.44, 12.4.31, 13.4.12
  • MediumCVE-2024-55892GHSA-2fx5-pggv-6jjr14 Jan 2025

    TYPO3 Potential Open Redirect via Parsing Differences

    Affected
    >=9.0.0 <9.5.49 · >=10.0.0 <10.4.48 · >=11.0.0 <11.5.42 · >=12.0.0 <12.4.25 · >=13.0.0 <13.4.3
    Fixed in
    9.5.49, 10.4.48, 11.5.42, 12.4.25, 13.4.3
  • MediumCVE-2024-34358GHSA-36g8-62qv-595714 May 2024

    TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController

    Affected
    >=9.0.0 <9.5.48 · >=10.0.0 <10.4.45 · >=11.0.0 <11.5.37 · >=12.0.0 <12.4.15 · >=13.0.0 <13.1.1
    Fixed in
    9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1
  • MediumCVE-2024-34357GHSA-hw6c-6gwq-3m3m14 May 2024

    TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController

    Affected
    >=9.0.0 <9.5.48 · >=10.0.0 <10.4.45 · >=11.0.0 <11.5.37 · >=12.0.0 <12.4.15 · >=13.0.0 <13.1.1
    Fixed in
    9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1
  • MediumCVE-2024-34356GHSA-v6mw-h7w6-59w314 May 2024

    TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module

    Affected
    >=9.0.0 <9.5.48 · >=10.0.0 <10.4.45 · >=11.0.0 <11.5.37 · >=12.0.0 <12.4.15 · >=13.0.0 <13.1.1
    Fixed in
    9.5.48, 10.4.45, 11.5.37, 12.4.15, 13.1.1
  • HighCVE-2024-22188GHSA-5w2h-59j3-8x5w13 Feb 2024

    TYPO3 Install Tool vulnerable to Code Execution

    Affected
    >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
    Fixed in
    8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  • MediumCVE-2023-30451GHSA-w6x2-jg8h-p6mp13 Feb 2024

    Path Traversal in TYPO3 File Abstraction Layer Storages

    Affected
    >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
    Fixed in
    8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  • HighCVE-2024-25121GHSA-rj3x-wvc6-5j6613 Feb 2024

    TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler

    Affected
    >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
    Fixed in
    8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  • MediumCVE-2024-25120GHSA-wf85-8hx9-gj7c13 Feb 2024

    TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme

    Affected
    >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
    Fixed in
    8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  • MediumCVE-2024-25119GHSA-h47m-3f78-qp9g13 Feb 2024

    TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key

    Affected
    >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
    Fixed in
    8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  • MediumCVE-2024-25118GHSA-38r2-5695-334w13 Feb 2024

    TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords

    Affected
    >=8.0.0 <8.7.57 · >=9.0.0 <9.5.46 · >=10.0.0 <10.4.43 · >=11.0.0 <11.5.35 · >=12.0.0 <12.4.11 · >=13.0.0 <13.0.1
    Fixed in
    8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  • MediumCVE-2023-47127GHSA-3vmm-7h4j-69rm14 Nov 2023

    TYPO3 vulnerable to Weak Authentication in Session Handling

    Affected
    >=8.0.0 <8.7.55 · >=9.0.0 <9.5.44 · >=10.0.0 <10.4.41 · >=11.0.0 <11.5.33 · >=12.0.0 <12.4.8
    Fixed in
    8.7.55, 9.5.44, 10.4.41, 11.5.33, 12.4.8
  • LowCVE-2023-38499GHSA-jq6g-4v5m-wm9r25 Jul 2023

    Information Disclosure due to Out-of-scope Site Resolution

    Affected
    >=9.4.0 <9.5.42 · >=10.0.0 <10.4.39 · >=11.0.0 <11.5.30 · >=12.0.0 <12.4.4
    Fixed in
    9.5.42, 10.4.39, 11.5.30, 12.4.4
  • HighCVE-2023-24814GHSA-r4f8-f93x-5qh38 Feb 2023

    TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering

    Affected
    >=12.0.0 <12.2.0 · >=11.0.0 <11.5.23 · >=10.0.0 <10.4.36 · >=9.0.0 <9.5.40 · >=8.7.0 <8.7.51
    Fixed in
    8.7.51, 9.5.40, 10.4.36, 11.5.23, 12.2.0
  • MediumCVE-2022-23504GHSA-8w3p-qh3x-6gjr13 Dec 2022

    TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

    Affected
    >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
    Fixed in
    9.5.38, 10.4.33, 11.5.20, 12.1.1
  • HighCVE-2022-23503GHSA-c5wx-6c2c-f7rm13 Dec 2022

    TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework

    Affected
    >=8.0.0 <8.7.49 · >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
    Fixed in
    8.7.49, 9.5.38, 10.4.33, 11.5.20, 12.1.1
  • MediumCVE-2022-23502GHSA-mgj2-q8wp-29rr13 Dec 2022

    TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset

    Affected
    >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
    Fixed in
    10.4.33, 11.5.20, 12.1.1
  • MediumCVE-2022-23501GHSA-jfp7-79g7-89rf13 Dec 2022

    TYPO3 CMS vulnerable to Weak Authentication in Frontend Login

    Affected
    <8.7.49 · >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
    Fixed in
    8.7.49, 9.5.38, 10.4.33, 11.5.20, 12.1.1
  • MediumCVE-2022-23500GHSA-8c28-5mp7-v24h13 Dec 2022

    TYPO3 CMS vulnerable to Denial of Service in Page Error Handling

    Affected
    >=9.0.0 <9.5.38 · >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20
    Fixed in
    9.5.38, 10.4.33, 11.5.20
  • MediumCVE-2022-36020GHSA-47m6-46mj-p23516 Sept 2022

    TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection

    Affected
    >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
    Fixed in
    10.4.32, 11.5.16
  • MediumCVE-2022-36105GHSA-m392-235j-9r7r16 Sept 2022

    TYPO3 CMS vulnerable to User Enumeration via Response Timing

    Affected
    >=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
    Fixed in
    7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
  • MediumCVE-2022-36106GHSA-5959-4x58-r8c216 Sept 2022

    TYPO3 CMS missing check for expiration time of password reset token for backend users

    Affected
    >=10.4.0 <10.4.32 · >=11.0.0 <11.5.16
    Fixed in
    10.4.32, 11.5.16
  • MediumCVE-2022-36107GHSA-9c6w-55cp-5w2516 Sept 2022

    TYPO3 CMS Stored Cross-Site Scripting via FileDumpController

    Affected
    >=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
    Fixed in
    7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
  • MediumCVE-2022-36108GHSA-fv2m-9249-qx8516 Sept 2022

    TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper

    Affected
    >=10.3.0 <10.4.32 · >=11.0.0 <11.5.16
    Fixed in
    10.4.32, 11.5.16
  • MediumGHSA-gqqf-g5r7-84vf15 Sept 2022

    TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection

    Affected
    >=7.0.0 <7.6.58 · >=8.0.0 <8.7.48 · >=9.0.0 <9.5.37 · >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
    Fixed in
    7.6.58, 8.7.48, 9.5.37, 10.4.32, 11.5.16
  • MediumCVE-2022-31050GHSA-wwjw-r3gj-39fq17 Jun 2022

    Insufficient Session Expiration in TYPO3's Admin Tool

    Affected
    >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
    Fixed in
    9.5.35, 10.4.29, 11.5.11
  • MediumCVE-2022-31049GHSA-h4mx-xv96-2jgm17 Jun 2022

    Cross-Site Scripting in TYPO3's Frontend Login Mailer

    Affected
    >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
    Fixed in
    9.5.35, 10.4.29, 11.5.11
  • MediumCVE-2022-31048GHSA-3r95-23jp-mhvg17 Jun 2022

    Cross-Site Scripting in TYPO3's Form Framework

    Affected
    >=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
    Fixed in
    8.7.47, 9.5.35, 10.4.29, 11.5.11
  • MediumCVE-2022-31047GHSA-fh99-4pgr-8j9917 Jun 2022

    Insertion of Sensitive Information into Log File in typo3/cms-core

    Affected
    >=7.0.0 <7.6.57 · >=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
    Fixed in
    7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
  • MediumCVE-2022-31046GHSA-8gmv-9hwg-w89g17 Jun 2022

    Information Disclosure via Export Module

    Affected
    >=7.0.0 <7.6.57 · >=8.0.0 <8.7.47 · >=9.0.0 <9.5.35 · >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
    Fixed in
    7.6.57, 8.7.47, 9.5.35, 10.4.29, 11.5.11
  • HighCVE-2021-41113GHSA-657m-v5vm-f6rw5 Oct 2021

    Cross-Site-Request-Forgery in Backend

    Affected
    >=11.2.0 <11.5.0
    Fixed in
    11.5.0
  • MediumCVE-2021-41114GHSA-m2jh-fxw4-gphm5 Oct 2021

    HTTP Host Header Injection

    Affected
    >=11.0.0 <11.5.0
    Fixed in
    11.5.0

Fixed within 11.3.x, affecting earlier releases

  • MediumCVE-2021-32768GHSA-c5c9-8c6m-727v19 Aug 2021

    Cross-Site Scripting via Rich-Text Content

    Affected
    >=7.0.0 <7.6.53 · >=8.0.0 <8.7.42 · >=10.0.0 <10.4.19 · >=11.0.0 <11.3.2 · >=9.0.0 <9.5.29
    Fixed in
    7.6.53, 8.7.42, 9.5.29, 10.4.19, 11.3.2
  • MediumCVE-2021-32767GHSA-34fr-fhqr-723526 Jul 2021

    Information Disclosure in User Authentication

    Affected
    >=7.0.0 <7.6.52 · >=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
    Fixed in
    7.6.52, 8.7.41, 9.5.28, 10.4.18, 11.3.1
  • MediumCVE-2021-32669GHSA-rgcg-28xm-8mmw22 Jul 2021

    Cross-Site Scripting in Backend Grid View

    Affected
    >=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
    Fixed in
    8.7.41, 9.5.28, 10.4.18, 11.3.1
  • MediumCVE-2021-32668GHSA-6mh3-j5r5-237922 Jul 2021

    Cross-Site Scripting in Query Generator & Query View

    Affected
    >=8.0.0 <8.7.41 · >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
    Fixed in
    8.7.41, 9.5.28, 10.4.18, 11.3.1
  • MediumCVE-2021-32667GHSA-8mq9-fqv8-59wf22 Jul 2021

    Cross-Site Scripting in Page Preview

    Affected
    >=9.0.0 <9.5.28 · >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1
    Fixed in
    9.5.28, 10.4.18, 11.3.1

Which of your client projects are still on typo3/cms-core 11.3?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact typo3/cms-core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other typo3/cms-core versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.