Known Vulnerabilities for TYPO3 CMS by TYPO3
Listed below are 10 of the newest known vulnerabilities associated with "TYPO3 CMS" by "TYPO3".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-109162 json | Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default ... | Not Provided | 2026-10-13 | 2026-10-14 |
| CVE-2026-85400 json | Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuratio... | Not Provided | 2026-09-08 | 2026-09-08 |
| CVE-2026-77138 json | The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize()... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-77132 json | It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization chec... | Not Provided | 2026-09-08 | 2026-09-08 |
| CVE-2026-77131 json | When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encryptin... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-77127 json | The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or ... | Not Provided | 2026-08-25 | 2026-08-25 |
| CVE-2026-56095 json | The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function wh... | Not Provided | 2026-08-25 | 2026-09-17 |
| CVE-2026-56094 json | The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's o... | Not Provided | 2026-08-25 | 2026-09-17 |
| CVE-2026-19418 json | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYP... | Not Provided | 2026-08-11 | 2026-08-11 |
| CVE-2023-50462 json | An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify wh... | Not Provided | 2026-09-14 | 2026-09-14 |