Typo3 vulnerabilities, page 5
412 vulnerabilities
Known vulnerabilities in Typo3 products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 125 products.
RoutineCVE-2026-4208typo3 · extension "e-mail mfa provider" +1 moreAuthentication Bypass in extension "E-Mail MFA Provider" (mfa_email)The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.CVSS8.8HighEPSS0.27%RoutineCVE-2026-4202typo3 · extension "redirect tabs" +1 moreBroken Access Control in extension "Redirect Tab"The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page.CVSS4.3MediumEPSS0.17%RoutineCVE-2026-1323typo3 · extension "mailqueue" +1 moreInsecure Deserialization in extension "Mailqueue" (mailqueue)The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].CVSS8.8HighEPSS0.23%RoutineCVE-2026-0895typo3 · extension "mailqueue"Insecure Deserialization in extension "Mailqueue" (mailqueue)The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .CVSS5.2MediumEPSS0.15%RoutineCVE-2026-0859typo3 · typo3 cms +1 moreTYPO3 CMS Allows Insecure Deserialization via Mailer File SpoolTYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.CVSS7.8HighEPSS0.18%RoutineCVE-2025-59022typo3 · typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Recycler ModuleBackend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.CVSS8.1HighEPSS0.42%RoutineCVE-2025-59021typo3 · typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Redirects ModuleBackend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.CVSS6.4MediumEPSS0.27%RoutineCVE-2025-59020typo3 · typo3 cms +1 moreTYPO3 CMS Allows Broken Access Control in Edit Document ControllerBy exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.CVSS6.5MediumEPSS0.31%RoutineGCVE-1-2025-0041typo3 +1 moretypo3 typo3The vulnerability, in a series (5) of online services in Luxembourg, occurs because a request parameter (e.g., a search or query parameter) is incorporated directly into the server-generated HTML response without proper escaping. As a result, specially crafted input containing HTML tags and attributes can be interpreted by the browser as active markup rather than plain text.
An attacker can exploit this behavior by injecting HTML elements with JavaScript-capable event handlers. When the page is rendered and a user interacts with it (for example, through scrolling or other UI actions), the injected JavaScript executes within the security context of the vulnerable website.
This is a reflected XSS issue, meaning the malicious payload is not stored server-side but is immediately reflected in the HTTP response to a single request. Successful exploitation requires a victim to follow a malicious link or otherwise load a request crafted by the attacker.
Those vulnerabilities originated from a misconfiguration of the online service.
**exclusively-hosted-service**CVSS6.4MediumPrioritiseCVE-2025-12998typo3 · extension "modules"Broken Authentication in extension “Modules” (modules)Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.CVSS8.2HighEPSS0.36%RoutineCVE-2025-10316typo3 · extension "form to database" (form_to_database)Cross-Site Scripting in extension "Form to Database" (form_to_database)The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.CVSS2.3LowEPSS0.33%RoutineCVE-2025-59019typo3 · typo3 cms +1 moreInformation Disclosure via CSV DownloadMissing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.CVSS5.3MediumEPSS0.24%RoutineCVE-2025-59018typo3 · typo3 cms +1 moreInformation Disclosure in Workspaces ModuleMissing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX backend route to disclose sensitive information without having access.CVSS7.1HighEPSS0.29%RoutineCVE-2025-59017typo3 · typo3 cms +1 moreBroken Access Control in Backend AJAX RoutesMissing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules.CVSS8.8HighEPSS0.30%RoutineCVE-2025-59016typo3 · typo3 cms +1 moreInformation Disclosure via File Abstraction LayerError messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.CVSS5.3MediumEPSS0.24%RoutineCVE-2025-59015typo3 · typo3 cms +1 moreInsufficient Entropy in Password GenerationA deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.CVSS6.5MediumEPSS0.19%RoutineCVE-2025-59014typo3 · typo3 cms +1 moreDenial of Service in TYPO3 Bookmark ToolbarAn uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.CVSS5.1MediumEPSS0.29%RoutineCVE-2025-59013typo3 · typo3 cms +1 moreOpen Redirect in TYPO3 CMSAn open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.CVSS6.1MediumEPSS0.18%RoutineCVE-2025-9573typo3 · extension "typo3 backup plus"Command Injection in extension "TYPO3 Backup Plus" (ns_backup)The ns_backup extension through 13.0.2 for TYPO3 allows command injection.CVSS8.6HighEPSS1.09%RoutineCVE-2025-7900typo3 · extension "femanager" +1 moreInsecure Direct Object Reference in extension "femanager" (femanager)The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager version 6.4.1 and below, 7.0.0 to 7.5.2 and 8.0.0 to 8.3.0CVSS6.5MediumEPSS0.25%