Is typo3/cms-core 14.3 vulnerable?

Composer · 11 releases from 14.3.0 to 14.3.10 · latest typo3/cms-core is 14.3.10 · checked 2 Nov 2026

No known advisories in the last release

typo3/cms-core 14.3.10, the last 14.3 release, has no known advisories. 14 advisories affect earlier 14.3.x releases, so update to 14.3.10.

Update within 14.3:composer require typo3/cms-core:^14.3.10

Is your project affected?

Private repo? Upload its lockfile instead, or connect GitHub to check every repo.

Fixed within 14.3.x, affecting earlier releases

  • HighCVE-2026-19418GHSA-68jx-f42c-75991 Sept 2026

    TYPO3 CMS - Broken Access Control in Backend and Install Tool

    Affected
    >=14.0.0 <14.3.6
    Fixed in
    14.3.6
  • HighCVE-2026-11607GHSA-pjpj-v387-x4vq12 Jun 2026

    TYPO3 CMS has Broken Access Control in its Form Framework

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47349GHSA-f34x-rx2w-7pm312 Jun 2026

    TYPO3 CMS has Broken Access Control in the Recycler Module

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47347GHSA-3p42-w5ch-gg4212 Jun 2026

    TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • HighCVE-2026-47343GHSA-3v8v-4wg6-r7qh12 Jun 2026

    TYPO3 CMS: Destructive Actions on File Mount Folders

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • HighCVE-2026-49741GHSA-jh32-v29g-68pq12 Jun 2026

    TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

    Affected
    >=14.0.0 <14.3.3
    Fixed in
    14.3.3
  • MediumCVE-2026-47350GHSA-qcmw-6rm2-5x7812 Jun 2026

    TYPO3 CMS has Broken Access Control in its DataHandler

    Affected
    >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    13.4.31, 14.3.3
  • HighCVE-2026-47346GHSA-hwvq-2w67-rvxp12 Jun 2026

    TYPO3 CMS has Broken Access Control in its Form Framework

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • HighCVE-2026-49742GHSA-chm7-4vch-h8vr12 Jun 2026

    TYPO3 CMS has Broken Access Control in its Media Module

    Affected
    >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-49740GHSA-c78m-c52x-jgwp12 Jun 2026

    TYPO3 CMS has Insecure Deserialization via Core API

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • LowCVE-2026-49738GHSA-jf56-v8jc-jcc512 Jun 2026

    TYPO3 CMS has Broken Access Control in its File Abstraction Layer

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47352GHSA-2j54-93q2-3hjq12 Jun 2026

    TYPO3 CMS has Broken Access Control in Backend API

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47351GHSA-q93m-25xv-94hh12 Jun 2026

    TYPO3 CMS: Broken Access Control in Media Module

    Affected
    <10.4.57 · >=11.0.0 <11.5.51 · >=12.0.0 <12.4.46 · >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  • MediumCVE-2026-47348GHSA-cg75-qfg2-w9hj12 Jun 2026

    TYPO3 CMS has Cross-Site Scripting in Indexed Search

    Affected
    >=13.0.0 <13.4.31 · >=14.0.0 <14.3.3
    Fixed in
    13.4.31, 14.3.3

Which of your client projects are still on typo3/cms-core 14.3?

NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact typo3/cms-core version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

Other typo3/cms-core versions

Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the Composer registry. Refreshed daily.