Typo3 vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-113459 In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI servicHigh 7.1 · Oct 20, 2026
• CVE-2026-112239 The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record.High 7.2 · Oct 20, 2026
• CVE-2026-112238 The file search of the extension builds its database conditions by wrapping the search term in quotes itself.High 8.7 · Oct 20, 2026
• CVE-2026-112066 The JSON import of the cookie consent configuration did not respect the backend user's permissions.High 7.1 · Oct 20, 2026
• CVE-2026-112064 The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without valHigh 7.1 · Oct 20, 2026
• CVE-2023-50461 An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3.High 8.8 · Sep 14, 2026
• CVE-2026-85400 Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commaHigh 7.5 · Sep 8, 2026
• CVE-2026-77146 The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), alloHigh 8.3 · Aug 25, 2026
• CVE-2026-77145 The permission check for the frontend management update flow verified a different event than the one the request went on to modify.High 7.1 · Aug 25, 2026
• CVE-2026-77144 The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its ownHigh 7.1 · Aug 25, 2026
• CVE-2026-77143 The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified.High 8.8 · Aug 25, 2026
• CVE-2026-77142 The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, bHigh 8.8 · Aug 25, 2026
• CVE-2026-77141 The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownersHigh 8.8 · Aug 25, 2026
• CVE-2026-77140 The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change.High 8.7 · Aug 25, 2026
• CVE-2026-77138 The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize().Critical 9.3 · Aug 25, 2026
• CVE-2026-77137 The extension fails to properly sanitize user input before using it in a database query.High 7.7 · Aug 25, 2026
• CVE-2026-77136 The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, witCritical 9.5 · Aug 25, 2026
• CVE-2026-77135 The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to thHigh 8.2 · Aug 25, 2026
• CVE-2026-77134 The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainableHigh 8.3 · Aug 25, 2026
• CVE-2026-77129 The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction.High 7.7 · Aug 25, 2026
• CVE-2026-56095 The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data foHigh 7.7 · Aug 25, 2026
• CVE-2026-56092 The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisteHigh 7.6 · Aug 25, 2026
• CVE-2026-19418 The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend High 7.3 · Aug 11, 2026
• CVE-2026-49742 Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module.High 7.1 · Jun 9, 2026
• CVE-2026-49741 Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bHigh 8.7 · Jun 9, 2026