Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

typo3/cms-form

TYPO3 CMS Form - Flexible TYPO3 frontend form framework that comes with a backend editor interface.

Composer latest 13.4.35 GPL-2.0-or-later

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

13.4.35

No matching published advisory returned

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

High

8 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

8
GHSA-pjpj-v387-x4vq high

TYPO3 CMS has Broken Access Control in its Form Framework

Affected range

ECOSYSTEM: introduced 0; fixed 10.4.57ECOSYSTEM: introduced 11.0.0; fixed 11.5.51ECOSYSTEM: introduced 12.0.0; fixed 12.4.46ECOSYSTEM: introduced 13.0.0; fixed 13.4.31ECOSYSTEM: introduced 14.0.0; fixed 14.3.3

Fixed versions: 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3

CVE-2026-11607 Source ↗Source ↗
GHSA-hwvq-2w67-rvxp high

TYPO3 CMS has Broken Access Control in its Form Framework

Affected range

ECOSYSTEM: introduced 0; fixed 10.4.57ECOSYSTEM: introduced 11.0.0; fixed 11.5.51ECOSYSTEM: introduced 12.0.0; fixed 12.4.46ECOSYSTEM: introduced 13.0.0; fixed 13.4.31ECOSYSTEM: introduced 14.0.0; fixed 14.3.3

Fixed versions: 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3

CVE-2026-47346 Source ↗Source ↗
GHSA-2r6j-862c-m2v2 high

Unrestricted File Upload in Form Framework

Affected range

ECOSYSTEM: introduced 8.0.0; fixed 8.7.40ECOSYSTEM: introduced 9.0.0; fixed 9.5.25ECOSYSTEM: introduced 10.0.0; fixed 10.4.14ECOSYSTEM: introduced 11.0.0; fixed 11.1.1>=11.0.0,<=11.1.0|>=10.0.0,<=10.4.13|>=9.0.0,<=9.5.24|>=8.0.0,<=8.7.39

Fixed versions: 8.7.40, 9.5.25, 10.4.14, 11.1.1

CVE-2021-21355 Source ↗Source ↗
GHSA-3vg7-jw9m-pc3f high

Broken Access Control in Form Framework

Affected range

ECOSYSTEM: introduced 8.0.0; fixed 8.7.40ECOSYSTEM: introduced 9.0.0; fixed 9.5.25ECOSYSTEM: introduced 10.0.0; fixed 10.4.14ECOSYSTEM: introduced 11.0.0; fixed 11.1.1>=11.0.0,<=11.1.0|>=10.0.0,<=10.4.13|>=9.0.0,<=9.5.24|>=8.0.0,<=8.7.39

Fixed versions: 8.7.40, 9.5.25, 10.4.14, 11.1.1

CVE-2021-21357 Source ↗Source ↗
GHSA-x79j-wgqv-g8h2 moderate

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form

Affected range

ECOSYSTEM: introduced 10.2.0; fixed 10.4.14ECOSYSTEM: introduced 11.0.0; fixed 11.1.1>=11.0.0,<=11.1.0|>=10.2.0,<=10.4.13

Fixed versions: 10.4.14, 11.1.1

CVE-2021-21358 Source ↗Source ↗
GHSA-ww7h-g2qf-7xv6 moderate

TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.48ECOSYSTEM: introduced 11.0.0; fixed 11.5.42ECOSYSTEM: introduced 12.0.0; fixed 12.4.25ECOSYSTEM: introduced 13.0.0; fixed 13.4.3>=13.0.0,<=13.4.2|>=12.0.0,<=12.4.24|>=11.0.0,<=11.5.41|>=10.0.0,<=10.4.47

Fixed versions: 10.4.48, 11.5.42, 12.4.25, 13.4.3

CVE-2024-55922 Source ↗Source ↗