Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

typo3/cms-backend

TYPO3 CMS backend

Composer latest 13.4.35 GPL-2.0-or-later

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

13.4.35

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

26 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

26
GHSA-744g-7qm9-hjh9 high

The TYPO3 CMS Backend has Broken Authentication in Backend MFA

Affected range

ECOSYSTEM: introduced 12.0.0; fixed 12.4.31ECOSYSTEM: introduced 13.0.0; fixed 13.4.12>=13.0.0,<=13.4.11|>=12.0.0,<=12.4.30

Fixed versions: 12.4.31, 13.4.12

CVE-2025-47941 Source ↗Source ↗
GHSA-3cqw-pxgr-jhrm high

TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name

Affected range

ECOSYSTEM: introduced 0; last affected 4.0.13ECOSYSTEM: introduced 4.1.0; fixed 4.1.13ECOSYSTEM: introduced 4.2.0; fixed 4.2.10ECOSYSTEM: introduced 4.3alpha1; fixed 4.3beta2>=4.3alpha1,<4.3beta2|>=4.2.0,<4.2.10|>=4.1.0,<4.1.13|<=4.0.13

Fixed versions: 4.1.13, 4.2.10, 4.3beta2

CVE-2009-3631 Source ↗Source ↗
GHSA-4rvc-5hrh-qmwf high

TYPO3 SQL injection vulnerability on the backend

Affected range

ECOSYSTEM: introduced 0; fixed 4.1.14ECOSYSTEM: introduced 4.2.0; fixed 4.2.13ECOSYSTEM: introduced 4.3.0; fixed 4.3.4ECOSYSTEM: introduced 4.4.0; fixed 4.4.1>=4.4.0,<4.4.1|>=4.3.0,<4.3.4|>=4.2.0,<4.2.13|<4.1.14

Fixed versions: 4.1.14, 4.2.13, 4.3.4, 4.4.1

CVE-2010-3662 Source ↗Source ↗
GHSA-wjpc-gjf7-9938 high

TYPO3 Arbitrary Code Execution vulnerability on the backend

Affected range

ECOSYSTEM: introduced 0; fixed 4.1.14ECOSYSTEM: introduced 4.2; fixed 4.2.13ECOSYSTEM: introduced 4.3; fixed 4.3.4ECOSYSTEM: introduced 4.4; fixed 4.4.1>=4.4,<4.4.1|>=4.3,<4.3.4|>=4.2,<4.2.13|<4.1.14

Fixed versions: 4.1.14, 4.2.13, 4.3.4, 4.4.1

CVE-2010-3663 Source ↗Source ↗
GHSA-q93m-25xv-94hh moderate

TYPO3 CMS: Broken Access Control in Media Module

Affected range

ECOSYSTEM: introduced 0; fixed 10.4.57ECOSYSTEM: introduced 11.0.0; fixed 11.5.51ECOSYSTEM: introduced 12.0.0; fixed 12.4.46ECOSYSTEM: introduced 13.0.0; fixed 13.4.31ECOSYSTEM: introduced 14.0.0; fixed 14.3.3

Fixed versions: 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3

CVE-2026-47351 Source ↗Source ↗
GHSA-2j54-93q2-3hjq moderate

TYPO3 CMS has Broken Access Control in Backend API

Affected range

ECOSYSTEM: introduced 0; fixed 10.4.57ECOSYSTEM: introduced 11.0.0; fixed 11.5.51ECOSYSTEM: introduced 12.0.0; fixed 12.4.46ECOSYSTEM: introduced 13.0.0; fixed 13.4.31ECOSYSTEM: introduced 14.0.0; fixed 14.3.3

Fixed versions: 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3

CVE-2026-47352 Source ↗Source ↗
GHSA-fjh3-g8gq-9q92 moderate

Cross-Site Scripting in Content Preview

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.14ECOSYSTEM: introduced 11.0.0; fixed 11.1.1>=11.0.0,<=11.1.0|>=10.0.0,<=10.4.13

Fixed versions: 10.4.14, 11.1.1

CVE-2021-21340 Source ↗Source ↗
GHSA-x7hc-x7fm-f7qh moderate

Cross-Site Scripting in Content Preview (CType menu)

Affected range

ECOSYSTEM: introduced 7.0.0; fixed 7.6.51ECOSYSTEM: introduced 8.0.0; fixed 8.7.40ECOSYSTEM: introduced 9.0.0; fixed 9.5.25ECOSYSTEM: introduced 10.0.0; fixed 10.4.14ECOSYSTEM: introduced 11.0.0; fixed 11.1.1

Fixed versions: 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1

CVE-2021-21370 Source ↗Source ↗
GHSA-5j7q-wmh7-cqhg moderate

TYPO3 CMS Allows Broken Access Control in Edit Document Controller

Affected range

ECOSYSTEM: introduced 14.0.0; fixed 14.0.2ECOSYSTEM: introduced 13.0.0; fixed 13.4.23ECOSYSTEM: introduced 12.0.0; fixed 12.4.41ECOSYSTEM: introduced 11.0.0; fixed 11.5.49ECOSYSTEM: introduced 10.0.0; fixed 10.4.55

Fixed versions: 14.0.2, 13.4.23, 12.4.41, 11.5.49, 10.4.55

CVE-2025-59020 Source ↗Source ↗
GHSA-j8vm-7q52-2m2m moderate

TYPO3 CSV download feature information disclosure

Affected range

ECOSYSTEM: introduced 12.0.0; fixed 12.4.37ECOSYSTEM: introduced 13.0.0; fixed 13.4.18>=13.0.0,<13.4.18|>=12.0.0,<12.4.37

Fixed versions: 12.4.37, 13.4.18

CVE-2025-59019 Source ↗Source ↗
GHSA-2fhw-2j7m-mr4m moderate

TYPO3 backend modules have Broken Access Control

Affected range

ECOSYSTEM: introduced 9.0.0; fixed 12.4.37ECOSYSTEM: introduced 10.0.0; fixed 12.4.37ECOSYSTEM: introduced 11.0.0; fixed 12.4.37ECOSYSTEM: introduced 12.0.0; fixed 12.4.37ECOSYSTEM: introduced 13.0.0; fixed 13.4.18

Fixed versions: 12.4.37, 13.4.18

CVE-2025-59017 Source ↗Source ↗
GHSA-xrcq-533q-8rxw moderate

TYPO3 Bookmark Toolbar vulnerable to denial of service

Affected range

ECOSYSTEM: introduced 11.0.0; fixed 12.4.37ECOSYSTEM: introduced 12.0.0; fixed 12.4.37ECOSYSTEM: introduced 13.0.0; fixed 13.4.18>=13.0.0,<13.4.18|>=12.0.0,<12.4.37|>=11.0.0,<11.5.48

Fixed versions: 12.4.37, 13.4.18

CVE-2025-59014 Source ↗Source ↗
GHSA-mg66-3x8x-r8g2 moderate

TYPO3 Backend vulnerable to Frame Hijacking

Affected range

ECOSYSTEM: introduced 0; last affected 4.0.13ECOSYSTEM: introduced 4.1.0; fixed 4.1.13ECOSYSTEM: introduced 4.2.0; fixed 4.2.10ECOSYSTEM: introduced 4.3alpha1; fixed 4.3beta2>=4.3alpha1,<4.3beta2|>=4.2.0,<4.2.10|>=4.1.0,<4.1.13|<=4.0.13

Fixed versions: 4.1.13, 4.2.10, 4.3beta2

CVE-2009-3630 Source ↗Source ↗
GHSA-2wgg-c8xc-7gg3 moderate

TYPO3 Backend Discloses Encryption Key

Affected range

ECOSYSTEM: introduced 0; last affected 4.0.13ECOSYSTEM: introduced 4.1.0; fixed 4.1.13ECOSYSTEM: introduced 4.2.0; fixed 4.2.10ECOSYSTEM: introduced 4.3alpha1; fixed 4.3beta2>=4.3alpha1,<4.3beta2|>=4.2.0,<4.2.10|>=4.1.0,<4.1.13|<=4.0.13

Fixed versions: 4.1.13, 4.2.10, 4.3beta2

CVE-2009-3628 Source ↗Source ↗
GHSA-mwqv-jff6-5v62 moderate

TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backend

Affected range

ECOSYSTEM: introduced 4.2.0; fixed 4.2.15ECOSYSTEM: introduced 4.3.0; fixed 4.3.7ECOSYSTEM: introduced 4.4.0; fixed 4.4.4>=4.4.0,<4.4.4|>=4.3.0,<4.3.7|>=4.2.0,<4.2.15

Fixed versions: 4.2.15, 4.3.7, 4.4.4

CVE-2010-3715 Source ↗Source ↗
GHSA-jr79-65xr-q7cx moderate

TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms

Affected range

ECOSYSTEM: introduced 4.1.0; fixed 4.1.14ECOSYSTEM: introduced 4.2.0; fixed 4.2.13ECOSYSTEM: introduced 4.3.0; fixed 4.3.4ECOSYSTEM: introduced 4.4.0; fixed 4.4.1>=4.4.0,<4.4.1|>=4.3.0,<4.3.4|>=4.2.0,<4.2.13|>=4.1.0,<4.1.14

Fixed versions: 4.1.14, 4.2.13, 4.3.4, 4.4.1

CVE-2010-3659 Source ↗Source ↗
GHSA-8xp9-99h5-4vcg moderate

TYPO3 is vulnerable to Information Disclosure on the backend

Affected range

ECOSYSTEM: introduced 0; fixed 4.1.14ECOSYSTEM: introduced 4.2.0; fixed 4.2.13ECOSYSTEM: introduced 4.3.0; fixed 4.3.4ECOSYSTEM: introduced 4.4.0; fixed 4.4.1>=4.4.0,<4.4.1|>=4.3.0,<4.3.4|>=4.2.0,<4.2.13|<4.1.14

Fixed versions: 4.1.14, 4.2.13, 4.3.4, 4.4.1

CVE-2010-3664 Source ↗Source ↗
GHSA-j628-384g-rmgc moderate

TYPO3 Open Redirection vulnerability on the backend

Affected range

ECOSYSTEM: introduced 0; fixed 4.1.14ECOSYSTEM: introduced 4.2.0; fixed 4.2.13ECOSYSTEM: introduced 4.3.0; fixed 4.3.4ECOSYSTEM: introduced 4.4.0; fixed 4.4.1>=4.4.0,<4.4.1|>=4.3.0,<4.3.4|>=4.2.0,<4.2.13|<4.1.14

Fixed versions: 4.1.14, 4.2.13, 4.3.4, 4.4.1

CVE-2010-3661 Source ↗Source ↗
GHSA-cg45-qgcf-hf9x moderate

TYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backend

Affected range

ECOSYSTEM: introduced 0; fixed 4.1.14ECOSYSTEM: introduced 4.2.0; fixed 4.2.13ECOSYSTEM: introduced 4.3.0; fixed 4.3.4ECOSYSTEM: introduced 4.4.0; fixed 4.4.1>=4.4.0,<4.4.1|>=4.3.0,<4.3.4|>=4.2.0,<4.2.13|<4.1.14

Fixed versions: 4.1.14, 4.2.13, 4.3.4, 4.4.1

CVE-2010-3660 Source ↗Source ↗
GHSA-ffcv-v6pw-qhrp low

Denial of Service in TYPO3 Bookmark Toolbar

Affected range

ECOSYSTEM: introduced 13.0.0; fixed 13.3.1ECOSYSTEM: introduced 12.0.0; fixed 12.4.21ECOSYSTEM: introduced 11.0.0; fixed 11.5.40ECOSYSTEM: introduced 10.0.0; fixed 10.4.46>=10.0.0,<=10.4.45|>=11.0.0,<=11.5.39|>=12.0.0,<12.4.20|=13.0.0

Fixed versions: 13.3.1, 12.4.21, 11.5.40, 10.4.46

CVE-2024-34537 Source ↗Source ↗
GHSA-rf5m-h8q9-9w6q low

Information Disclosure in TYPO3 Page Tree

Affected range

ECOSYSTEM: introduced 13.0.0; fixed 13.3.1ECOSYSTEM: introduced 12.0.0; fixed 12.4.21ECOSYSTEM: introduced 11.0.0; fixed 11.5.40ECOSYSTEM: introduced 10.0.0; fixed 10.4.46>=10.0.0,<10.4.46|>=11.0.0,<11.5.40|>=12.0.0,<12.4.21|>=13.0.0,<13.3.1

Fixed versions: 13.3.1, 12.4.21, 11.5.40, 10.4.46

CVE-2024-47780 Source ↗Source ↗
GHSA-g857-p997-wx7w low

TYPO3 Backend vulnerable to Cross-site Scripting

Affected range

ECOSYSTEM: introduced 0; last affected 4.0.13ECOSYSTEM: introduced 4.1.0; fixed 4.1.13ECOSYSTEM: introduced 4.2.0; fixed 4.2.10ECOSYSTEM: introduced 4.3alpha1; fixed 4.3beta2>=4.3alpha1,<4.3beta2|>=4.2.0,<4.2.10|>=4.1.0,<4.1.13|<=4.0.13

Fixed versions: 4.1.13, 4.2.10, 4.3beta2

CVE-2009-3629 Source ↗Source ↗
Show 1 more advisories
PKSA-745m-816f-bzfy TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard