Typo3 vulnerabilities, page 4
412 vulnerabilities
Known vulnerabilities in Typo3 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 125 products.
RoutineCVE-2026-47352typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in Backend APIAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS5.3MediumEPSS0.24%RoutineCVE-2026-47351typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in ClipboardBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.CVSS5.3MediumEPSS0.24%RoutineCVE-2026-47350typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in DataHandlerBackend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS5.3MediumEPSS0.24%RoutineCVE-2026-47349typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in RecyclerBackend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS5.3MediumEPSS0.24%RoutineCVE-2026-47348typo3 · typo3 cmsTYPO3 CMS - Cross-Site Scripting in Indexed SearchEditors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS5.1MediumEPSS0.27%RoutineCVE-2026-47347typo3 · typo3 cmsTYPO3 CMS - Open Redirect in Core UtilitiesApplications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS5.3MediumEPSS0.29%RoutineCVE-2026-47346typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in Form FrameworkBackend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS7.6HighEPSS0.25%RoutineCVE-2026-47343typo3 · typo3 cmsTYPO3 CMS - Destructive Actions on File Mount FoldersNon-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.CVSS7.2HighEPSS0.24%RoutineCVE-2026-11607typo3 · typo3 cmsTYPO3 CMS - Broken Access Control in Form FrameworkBackend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.CVSS7.6HighEPSS0.24%RoutineCVE-2026-47345typo3 · html_sanitizerTYPO3 HTML Sanitizer allows Cross-Site ScriptingNamespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.CVSS5.1MediumEPSS0.47%RoutineCVE-2026-47344typo3 · html_sanitizerTYPO3 HTML Sanitizer allows Cross-Site ScriptingWhen ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.CVSS2.1LowEPSS0.28%PrioritiseCVE-2026-46725typo3 · extension "content element selector"Remote Code Execution in extension "Content Element Selector" (ceselector)The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.CVSS9.2CriticalEPSS2.63%PrioritiseCVE-2026-8827typo3 · extension "address list"SQL Injection in extension "Address List" (tt_address)The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.CVSS8.2HighEPSS0.33%RoutineCVE-2026-46724typo3 · extension "faceted search"Path Traversal in extension "Faceted Search" (ke_search)The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.CVSS5.9MediumEPSS0.40%RoutineCVE-2026-46723typo3 · extension "faceted search"Information Disclosure in extension "Faceted Search" (ke_search)The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.CVSS5.9MediumEPSS0.32%RoutineCVE-2026-46722typo3 · extension "faceted search"XML External Entity Injection in extension "Faceted Search" (ke_search)The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.CVSS5.9MediumEPSS0.30%PrioritiseCVE-2026-8726typo3 · extension "news system"SQL Injection in extension "News system" (news)The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.CVSS8.2HighEPSS0.44%RoutineCVE-2026-46721typo3 · extension "frontend user registration"Broken Access Control in extension "Frontend User Registration" (sf_register)The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.CVSS6.9MediumEPSS0.36%RoutineCVE-2026-8727typo3 · extension "site crawler"Remote Code Execution in extension "Site Crawler" (crawler)The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.CVSS7.1HighEPSS0.39%RoutineCVE-2026-6553typo3 · typo3 cms +1 moreTYPO3 CMS Stores Cleartext Password in User Settings ModuleChanging backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.CVSS7.5HighEPSS0.17%