Typo3 vulnerabilities, page 3
412 vulnerabilities
Known vulnerabilities in Typo3 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 125 products.
RoutineCVE-2026-77133typo3 · extension "femanager"Broken Access Control in extension "femanager" (femanager)The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.CVSS6.0MediumEPSS0.35%PrioritiseCVE-2026-77134typo3 · extension "femanager"Broken Access Control in extension "femanager" (femanager)The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pending account awaiting admin approval.CVSS8.3HighEPSS0.41%PrioritiseCVE-2026-77135typo3 · extension "femanager"Information Disclosure in extension "femanager" (femanager)The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, date of birth and address, by supplying an arbitrary user ID.CVSS8.2HighEPSS0.41%PrioritiseCVE-2026-77136typo3 · extension "powermail"Server-Side Template Injection in extension "powermail" (powermail)The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template syntax in that field to execute arbitrary Fluid ViewHelpers leading to disclosure of server configuration, environment variables and application source, and potentially remote code execution. Exploitation requires only that a form field is configured as the sender_name field, a common and default-adjacent Powermail configuration. No authentication or user interaction beyond a normal form submission is required. This vulnerability is reported to be actively exploited in the wild.CVSS9.5CriticalEPSS0.97%RoutineCVE-2026-77137typo3 · extension "forms export"SQL Injection in extension "Forms Export" (frp_form_answers)The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.CVSS7.7HighEPSS0.40%PrioritiseCVE-2026-77138typo3 · extension "html5 video player vs. powermail"Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.CVSS9.3CriticalEPSS0.72%RoutineCVE-2026-77139typo3 · extension "mask"Path Traversal in extension "Mask" (mask)The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.CVSS6.0MediumEPSS0.44%PrioritiseCVE-2026-77140typo3 · extension "telephone directory"Broken Access Control in extension "Telephone Directory" (telephonedirectory)The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST request to the update action and overwrite that record without a valid edit link or any ownership check.CVSS8.7HighEPSS0.41%PrioritiseCVE-2026-77141typo3 · extension "club directory"Broken Access Control in extension "Club Directory" (clubdirectory)The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a direct request to the update or activate action and overwrite that record, or publish one still awaiting approval, without owning it.CVSS8.8HighEPSS0.41%PrioritiseCVE-2026-77142typo3 · extension "industry directory"Broken Access Control in extension "Industry Directory" (yellowpages2)The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a result, a visitor who knows the identifier of a company record from the public directory can submit a modified update request for that record directly and overwrite its data, without the application ever confirming that the visitor owns it.CVSS8.8HighEPSS0.41%PrioritiseCVE-2026-77143typo3 · extension "forum"Broken Access Control in extension "Forum" (pforum)The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic directly and overwrite its content, without the application confirming ownership. Topic identifiers are visible in the public forum listing, and exploitation requires no privileged access or non-default configuration.CVSS8.8HighEPSS0.41%RoutineCVE-2026-77144typo3 · extension "events 2"Broken Access Control in extension "Events 2" (events2)The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role. A user with frontend event management access could therefore create an event that is attributed to another organizer.CVSS7.1HighEPSS0.41%RoutineCVE-2026-77145typo3 · extension "events 2"Broken Access Control in extension "Events 2" (events2)The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.CVSS7.1HighEPSS0.35%PrioritiseCVE-2026-77146typo3 · extension "femanager"Broken Access Control in extension "femanager" (femanager)The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing frontend user account. This vulnerability is only present in the 8.x versions of the extension.CVSS8.3HighEPSS0.42%RoutineCVE-2026-19418typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in Backend and Install ToolThe referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory.
Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints.
Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.CVSS7.3HighEPSS0.24%RoutineCVE-2026-15305typo3 · typo3 cmsTYPO3 CMS - Unrestricted File Upload in Form FrameworkUsers were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.CVSS6.3MediumEPSS0.25%RoutineCVE-2026-49742typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in Media ModuleBackend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS7.1HighEPSS0.31%RoutineCVE-2026-49741typo3 · typo3 cmsTYPO3 CMS - Privilege Escalation & SQL Injection in Form FrameworkBackend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.CVSS8.7HighEPSS0.24%RoutineCVE-2026-49740typo3 · typo3 cmsTYPO3 CMS - Insecure Deserialization in Core APITYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store or sys_registry database table) could inject a crafted serialized payload to trigger PHP Object Injection, potentially exploiting a gadget chain to achieve Remote Code Execution or other high-impact effects. Exploiting this vulnerability requires direct local write access to the storage, such as the SQL database or file system. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS6.3MediumEPSS0.21%RoutineCVE-2026-49738typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in File Abstraction LayerThe path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS2.1LowEPSS0.36%