TYPO3 vulnerabilities
We track 52 vulnerabilities in TYPO3 products across 26 products. 52 are rated high or critical, and none are known to be exploited. The most recent was published on November 3, 2026.
Latest TYPO3 vulnerabilities
- 8.8 High severity
Extension "Frontend User Registration": Authorization Bypass Through User-Controlled Key
The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can there
- 7.1 High severity
Extension "Mail": Missing Authorization
Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups
- 7.1 High severity
Extension "TYPO3 AI Integration Extension": Insertion of Sensitive Information Into Sent Data
In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expen
- 7.2 High severity
Extension "TYPO3 AI Integration Extension": Missing Authorization
The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any
- 8.7 High severity
Extension "File manager": Improper Neutralization of Special Elements used in an SQL Command
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string
- 7.1 High severity
Extension "sgalinski Cookie Consent": Missing Authorization
The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
- 7.1 High severity
Extension "sgalinski Cookie Consent": Improper Neutralization of Special Elements used in an SQL Command
The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with acce
- 8.8 High severity
direct_mail: Incorrect Authorization
An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploit
- 7.5 High severity
TYPO3 CMS: Incorrect Privilege Assignment
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system
- 8.3 High severity
Extension "femanager": Missing Authorization
The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing front
- 7.1 High severity
Extension "Events 2": Authorization Bypass Through User-Controlled Key
The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers.
- 7.1 High severity
Extension "Events 2": Improperly Controlled Modification of Dynamically-Determined Object Attributes
The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organizer role.
- 8.8 High severity
Extension "Forum": Authorization Bypass Through User-Controlled Key
The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for that topic d
- 8.8 High severity
Extension "Industry Directory": Authorization Bypass Through User-Controlled Key
The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a r
- 8.8 High severity
Extension "Club Directory": Authorization Bypass Through User-Controlled Key
The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a d
- 8.7 High severity
Extension "Telephone Directory": Authorization Bypass Through User-Controlled Key
The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST reques
- 9.3 Critical severity
Extension "HTML5 Video Player vs. Powermail": Deserialization of Untrusted Data
The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Ex
- 7.7 High severity
Extension "Forms Export": Improper Neutralization of Special Elements used in an SQL Command
The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privilege
- 9.5 Critical severity
Extension "powermail": Improper Neutralization of Special Elements Used in a Template Engine
The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template
- 8.2 High severity
Extension "femanager": Authorization Bypass Through User-Controlled Key
The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, dat
- 8.3 High severity
Extension "femanager": Incorrect Authorization
The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pendi
- 7.7 High severity
Extension "Event management and registration": Improper Neutralization of Special Elements Used in a Template Engine
The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sensi
- 7.7 High severity
Extension "Apache Solr for TYPO3 - Enterprise…: Deserialization of Untrusted Data
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a saf
- 7.6 High severity
Extension "Apache Solr for TYPO3 - Enterprise…: Missing Authorization
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited a
- 7.3 High severity
TYPO3 CMS: Origin Validation Error
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ dire
- 7.1 High severity
TYPO3 CMS: Improper Limitation of a Pathname to a Restricted Directory
Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sen
- 8.7 High severity
TYPO3 CMS: Improper Neutralization of Special Elements used in an SQL Command
Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting a
- 7.6 High severity
TYPO3 CMS: Improper Handling of Case Sensitivity
Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL
- 7.2 High severity
TYPO3 CMS: Missing Authorization
Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10
- 7.6 High severity
TYPO3 CMS: Missing Authorization
Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary S
- 8.2 High severity
Extension "Address List": Improper Neutralization of Special Elements used in an SQL Command
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installatio
- 7.1 High severity
Extension "Site Crawler": Deserialization of Untrusted Data
The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. E
- 8.2 High severity
Extension "News system": Improper Neutralization of Special Elements used in an SQL Command
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the
- 9.2 Critical severity
Extension "Content Element Selector": Deserialization of Untrusted Data
The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution
- 7.5 High severity
TYPO3 CMS: Cleartext Storage of Sensitive Information
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
- 8.8 High severity
Extension "E-Mail MFA Provider": Authorization Bypass Through User-Controlled Key
The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider.
- 8.8 High severity
Extension "Mailqueue": Deserialization of Untrusted Data
The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOB
- 7.8 High severity
TYPO3 CMS: Deserialization of Untrusted Data
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects
- 8.1 High severity
TYPO3 CMS: Missing Authorization
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, eff
- 8.2 High severity
Extension "Modules": Improper Authentication
Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.