Skip to content
RequestGuard Vulnerabilities
Pricing
Vulnerability intelligence Composer

typo3/cms

TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.

Composer latest 13.4.35 GPL-2.0-or-later

Evidence path

Version, exploitation, severity

RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.

1

Latest version

13.4.35

Published advisories match this version

2

Known exploitation

No KEV match

Checked by exact CVE identifier

3

Highest advisory severity

Critical

190 active advisories

Check an exact version

The registry confirms the version, then OSV checks advisories for that exact value.

Published records

Advisories

190
GHSA-67wg-6j7r-mqh8 critical

Arbitrary Code Execution in TYPO3 CMS

Affected range

ECOSYSTEM: introduced 7.6.0; fixed 7.6.22ECOSYSTEM: introduced 8.0.0; fixed 8.7.5>=8.0.0,<8.7.23|>=9.0.0,<9.5.4

Fixed versions: 7.6.22, 8.7.5

Source ↗Source ↗
GHSA-gwfx-p7mr-f92v critical

Missing Access Check in TYPO3 CMS

Affected range

ECOSYSTEM: introduced 6.2.0; fixed 6.2.25ECOSYSTEM: introduced 7.6.0; fixed 7.6.8ECOSYSTEM: introduced 8.0.0; fixed 8.1.1>=6.2.0,<6.2.16|>=7.0.0,<7.1.0|>=7.1.0,<7.2.0|>=7.2.0,<7.3.0|>=7.3.0,<7.4.0|>=7.4.0,<7.5.0|>=7.5.0,<7.6.0|>=7.6.0,<7.6.1

Fixed versions: 6.2.25, 7.6.8, 8.1.1

Source ↗Source ↗
GHSA-79gv-5cgx-x6rx critical

Typo3 Authentication Bypass

Affected range

ECOSYSTEM: introduced 0; fixed 4.3.12ECOSYSTEM: introduced 4.4.0; fixed 4.4.9ECOSYSTEM: introduced 4.5.0; fixed 4.5.4>=4.5.0,<4.5.4|>=4.4.0,<4.4.9|<4.3.12

Fixed versions: 4.3.12, 4.4.9, 4.5.4

CVE-2011-4628 Source ↗Source ↗
GHSA-53mm-hx32-6475 critical

TYPO3 vulnerable to Insufficient Session Expiration

Affected range

ECOSYSTEM: introduced 0; fixed 2.0.5ECOSYSTEM: introduced 3.0.0; fixed 3.0.3>=3.0.0,<3.0.3|<2.0.5

Fixed versions: 2.0.5, 3.0.3

CVE-2022-47406 Source ↗Source ↗
GHSA-r4f8-f93x-5qh3 high

TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.35ECOSYSTEM: introduced 11.0.0; fixed 11.5.23ECOSYSTEM: introduced 12.0.0; fixed 12.2.0>=10.0.0,<10.4.35|>=11.0.0,<11.5.23|>=12.0.0,<12.2.0

Fixed versions: 10.4.35, 11.5.23, 12.2.0

CVE-2023-24814 Source ↗Source ↗
GHSA-2wj9-434x-9hvp high

Insecure Deserialization in Backend User Settings in TYPO3 CMS

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.2ECOSYSTEM: introduced 9.0.0; fixed 9.5.17>=10.0.0,<10.4.2|>=9.0.0,<9.5.17

Fixed versions: 10.4.2, 9.5.17

CVE-2020-11067 Source ↗Source ↗
GHSA-2rxh-h6h9-qrqc high

Class destructors causing side-effects when being unserialized in TYPO3 CMS

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.2ECOSYSTEM: introduced 9.0.0; fixed 9.5.17>=10.0.0,<10.4.2|>=9.0.0,<9.5.17

Fixed versions: 10.4.2, 9.5.17

CVE-2020-11066 Source ↗Source ↗
GHSA-2r6j-862c-m2v2 high

Unrestricted File Upload in Form Framework

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.14ECOSYSTEM: introduced 11.0.0; fixed 11.1.1ECOSYSTEM: introduced 9.0.0; fixed 9.5.25>=10.0.0,<10.4.14|>=11.0.0,<11.1.1|>=9.0.0,<9.5.25

Fixed versions: 10.4.14, 11.1.1, 9.5.25

CVE-2021-21355 Source ↗Source ↗
GHSA-3vg7-jw9m-pc3f high

Broken Access Control in Form Framework

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.14ECOSYSTEM: introduced 11.0.0; fixed 11.1.1ECOSYSTEM: introduced 9.0.0; fixed 9.5.25>=10.0.0,<10.4.14|>=11.0.0,<11.1.1|>=9.0.0,<9.5.25

Fixed versions: 10.4.14, 11.1.1, 9.5.25

CVE-2021-21357 Source ↗Source ↗
GHSA-3x94-fv5h-5q2c high

Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.6ECOSYSTEM: introduced 9.0.0; fixed 9.5.20>=10.0.0,<10.4.6|>=9.0.0,<9.5.20

Fixed versions: 10.4.6, 9.5.20

CVE-2020-15099 Source ↗Source ↗
GHSA-m5vr-3m74-jwxp high

Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.6ECOSYSTEM: introduced 9.0.0; fixed 9.5.20>=10.0.0,<10.4.6|>=9.0.0,<9.5.20

Fixed versions: 10.4.6, 9.5.20

CVE-2020-15098 Source ↗Source ↗
GHSA-pqg8-crx9-g8m4 high

Backend Same-Site Request Forgery in TYPO3 CMS

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.2ECOSYSTEM: introduced 9.0.0; fixed 9.5.17>=10.0.0,<10.4.2|>=9.0.0,<9.5.17

Fixed versions: 10.4.2, 9.5.17

CVE-2020-11069 Source ↗Source ↗
GHSA-954j-f27r-cj52 high

Cleartext storage of session identifier

Affected range

ECOSYSTEM: introduced 10.0.0; fixed 10.4.10ECOSYSTEM: introduced 9.0.0; fixed 9.5.23ECOSYSTEM: introduced 8.7.0; fixed 8.7.38>=10.0.0,<10.4.10|>=9.0.0,<9.5.23|>=8.7.0,<8.7.38

Fixed versions: 10.4.10, 9.5.23, 8.7.38

CVE-2020-26228 Source ↗Source ↗
GHSA-86hp-xrhj-fhpq high

TYPO3 Vulnerable to Insecure Deserialization

Affected range

ECOSYSTEM: introduced 8.0.0; fixed 8.7.27ECOSYSTEM: introduced 9.0.0; fixed 9.5.8>=8.0.0,<8.7.27|>=9.0.0,<9.5.8

Fixed versions: 8.7.27, 9.5.8

CVE-2019-12747 Source ↗Source ↗
GHSA-55g3-fjwm-w2c8 high

TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

Affected range

ECOSYSTEM: introduced 4.5.0; fixed 4.5.34ECOSYSTEM: introduced 4.7.0; fixed 4.7.19ECOSYSTEM: introduced 6.0.0; fixed 6.0.14ECOSYSTEM: introduced 6.1.0; fixed 6.1.9>=6.1.0,<6.1.9|>=6.0.0,<6.0.14|>=4.7.0,<4.7.19|>=4.5.0,<4.5.34

Fixed versions: 4.5.34, 4.7.19, 6.0.14, 6.1.9

CVE-2014-3942 Source ↗Source ↗
GHSA-m76j-69c2-c3m8 high

TYPO3 vulnerable to remote authenticated arbitrary code execution

Affected range

ECOSYSTEM: introduced 6.0.0; fixed 6.0.9ECOSYSTEM: introduced 6.1.0; fixed 6.1.4>=6.1.0,<6.1.4|>=6.0.0,<6.0.9

Fixed versions: 6.0.9, 6.1.4

CVE-2013-4321 Source ↗Source ↗
GHSA-54jj-pxx2-pv8h high

TYPO3 doesn't properly check file extensions

Affected range

ECOSYSTEM: introduced 6.0.0; fixed 6.0.8ECOSYSTEM: introduced 6.1.0; fixed 6.1.3>=6.1.0,<6.1.3|>=6.0.0,<6.0.8

Fixed versions: 6.0.8, 6.1.3

CVE-2013-4250 Source ↗Source ↗
GHSA-p84g-j2gh-83g3 high

TYPO3 possible cache poisoning on the homepage when anchors are used

Affected range

ECOSYSTEM: introduced 6.2.0; fixed 6.2.9ECOSYSTEM: introduced 7.0.0; fixed 7.0.2>=8.5.0,<8.7.17|>=9.0.0,<9.3.2

Fixed versions: 6.2.9, 7.0.2

Source ↗Source ↗
GHSA-45xg-4w5x-j429 high

TYPO3 Arbitrary Shell Execution in Swiftmailer library

Affected range

ECOSYSTEM: introduced 6.2.0; fixed 6.2.6ECOSYSTEM: introduced 6.1.0; fixed 6.1.12ECOSYSTEM: introduced 4.7.0; fixed 4.7.20ECOSYSTEM: introduced 4.5.0; fixed 4.5.37>=9.0.0,<9.5.6

Fixed versions: 6.2.6, 6.1.12, 4.7.20, 4.5.37

Source ↗Source ↗
GHSA-r9vc-jfmh-6j48 high

TYPO3 frontend login vulnerable to Session Fixation

Affected range

ECOSYSTEM: introduced 6.2.0; fixed 6.2.14ECOSYSTEM: introduced 7.0.0; fixed 7.3.1>=8.0.0,<8.7.27|>=9.0.0,<9.5.8

Fixed versions: 6.2.14, 7.3.1

Source ↗Source ↗
Show 75 more advisories
GHSA-4r76-xr68-w7m7 TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
GHSA-8h4m-r4wm-xj7r TYPO3 Arbitrary Code Execution via File List Module
GHSA-hh95-5xm5-v8v7 TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling
GHSA-c5mj-39cf-3pp5 TYPO3 Security Misconfiguration for Backend User Accounts
GHSA-g585-crjf-vhwq TYPO3 Denial of Service in Frontend Record Registration
GHSA-f777-f784-36gm TYPO3 Security Misconfiguration in Install Tool Cookie
GHSA-g4pf-3jvq-2gcw TYPO3 Remote Code Execution in third party library swiftmailer
GHSA-7qwg-fcpw-xg5g Privilege Escalation & SQL Injection in TYPO3 CMS
GHSA-5qp6-78pr-gv8c PHP OpenID Library Denial of Service vulnerability
GHSA-ppgf-8745-8pgx Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
GHSA-8h28-f46f-m87h Insecure Deserialization in TYPO3 CMS
GHSA-qffc-gwpp-m2xr XML External Entity (XXE) Processing in TYPO3 Core
GHSA-5479-gqqr-f9gj Typo3 Vulnerable to Cache Poisoning
GHSA-9895-53fc-98v2 TYPO3 SQL Injection in dbal
GHSA-rcgc-4xfc-564v TYPO3 Insecure Deserialization in Query Generator & Query View
GHSA-fh4q-hxrw-cjqq TYPO3 Arbitrary Code Execution
GHSA-w2fr-65vp-mxw3 Deserialization of untrusted data in Symfony
GHSA-3w4h-r27h-4r2w TYPO3 Image Processing susceptible to Code Execution
GHSA-w736-qv86-vq94 TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism
GHSA-74w6-ww7w-45j9 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
GHSA-q45q-5233-229p Authentication library in TYPO3 vulnerable to session fixation
GHSA-c5wx-6c2c-f7rm TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
PKSA-xycg-n8fx-k2xm Environment Variable Injection
GHSA-jg55-3q6h-2ccf Typo3 Backend XSS Vulnerability
GHSA-rgcg-28xm-8mmw Cross-Site Scripting in Backend Grid View
GHSA-vqqx-jw6p-q3rf Cross-Site Scripting in Fluid view helpers
GHSA-7733-hjv6-4h47 Cross-Site Scripting in ternary conditional operator
GHSA-8mq9-fqv8-59wf Cross-Site Scripting in Page Preview
GHSA-c5c9-8c6m-727v Cross-Site Scripting via Rich-Text Content
GHSA-qx3w-4864-94ch Cleartext storage of session identifier
GHSA-x79j-wgqv-g8h2 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form
GHSA-m2jh-fxw4-gphm HTTP Host Header Injection
GHSA-4jhw-2p6j-5wmp Open Redirection in Login Handling
GHSA-6mh3-j5r5-2379 Cross-Site Scripting in Query Generator & Query View
GHSA-fjh3-g8gq-9q92 Cross-Site Scripting in Content Preview
GHSA-x7hc-x7fm-f7qh Cross-Site Scripting in Content Preview (CType menu)
GHSA-4p9g-qgx9-397p Denial of Service in Page Error Handling
GHSA-34fr-fhqr-7235 Information Disclosure in User Authentication
GHSA-4j77-gg36-9864 Cross-Site Scripting in TYPO3 CMS Link Handling
GHSA-43gj-mj2w-wh46 Cross-Site Scripting in TYPO3 CMS Form Engine
GHSA-j5v7-9xr5-m7gx TYPO3 Cross-site Scripting vulnerability
GHSA-pj7m-g53m-7638 Bootstrap Cross-site Scripting vulnerability
GHSA-594h-cx6w-p4jf Typo3 Host Header Spoofing Vulnerability
GHSA-vccp-5v5h-p8m6 Typo3 Information Disclosure
GHSA-3f58-74qw-ph75 TYPO3 allows remote attackers to embed Flash videos from external domain
GHSA-xx7m-8rq2-cw2v TYPO3 CMS indexed search Cross-site Scripting vulnerability
GHSA-m4hw-r893-xh4g TYPO3 allows remote authenticated backend users to unserialize arbitrary objects
GHSA-q68v-vcjg-r3vp TYPO3 allows remote attackers to obtain the database name via a direct request
GHSA-r2w2-2r2x-fpcx TYPO3 SQL Injection vulnerability
GHSA-rmqc-wfjm-3f66 TYPO3 Directory Traversal vulnerability
GHSA-66j3-66cp-6c2m TYPO3 Path Traversal vulnerability
GHSA-hwrc-w5gg-f335 TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential
GHSA-c22j-84c7-cm77 TYPO3 leaks a hash secret in an error message
GHSA-59pj-7mjh-4465 TYPO3 SQL Injection in low-level Query Generator
GHSA-9j8h-xrgj-7gw2 TYPO3 Improper Session Invalidation
GHSA-mxjf-hc9v-xgv2 ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting
GHSA-pqfv-97hj-g97g TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure
GHSA-jqr8-q455-xx45 TYPO3 Brute Force Protection Bypass in backend login
GHSA-wp8j-c736-c5r3 TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors
GHSA-r287-hc8j-w56h TYPO3 Information Disclosure Vulnerability Exploitable by Editors
GHSA-6487-3qvg-8px9 TYPO3 Information Disclosure in Install Tool
GHSA-772m-43f3-hmf8 TYPO3 Broken Access Control in Localization Handling
GHSA-v8m4-3w37-ghxx TYPO3 Cross-Site Scripting in Form Framework validation handling
GHSA-8m6j-p5jv-v69w TYPO3 Cross-Site Scripting in Online Media Asset Rendering
GHSA-2rcw-9hrm-8q7q TYPO3 Cross-Site Scripting in Frontend User Login
GHSA-f3wf-q4fj-3gxf TYPO3 Denial of Service in Online Media Asset Handling
GHSA-4h5c-5g25-v7fh TYPO3 Cross-Site Scripting in Form Framework
GHSA-xgmx-j3hv-jh9x TYPO3 Cross-Site Scripting in Link Handling
GHSA-g7hw-jh4p-75wr TYPO3 Cross-Site Scripting in Filelist Module
GHSA-7q33-hxwj-7p8v TYPO3 Cross-Site Scripting in Backend Modal Component
GHSA-85ch-44w7-rf32 TYPO3 Cross-Site Scripting in Fluid ViewHelpers
GHSA-f624-8hfq-5fh3 TYPO3 Information Disclosure of Installed Extensions
GHSA-j6c3-3c4w-qv8p Moodle cross-site scripting (XSS) vulnerabilities
GHSA-hww5-6x85-mc24 Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API
GHSA-6xh8-8pfv-53vx Authentication Bypass in TYPO3 CMS