https://vulnogram.org/ Most recent CVEs assigned by TYPO3 Association (typo3). https://vulnogram.org/seaview/icons/typo3.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-112069 https://vulnogram.org/CVE-2026-112069 The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitab… Medium Network Exploitable Tue, 20 Oct 2026 09:30:57 GMT https://vulnogram.org/CVE-2026-112065 https://vulnogram.org/CVE-2026-112065 The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of… Medium Tue, 20 Oct 2026 09:30:56 GMT https://vulnogram.org/CVE-2026-112064 https://vulnogram.org/CVE-2026-112064 The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user… High Tue, 20 Oct 2026 09:30:55 GMT https://vulnogram.org/CVE-2026-112066 https://vulnogram.org/CVE-2026-112066 The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website. High Tue, 20 Oct 2026 09:30:55 GMT https://vulnogram.org/CVE-2026-112067 https://vulnogram.org/CVE-2026-112067 The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the def… Medium Network Exploitable Tue, 20 Oct 2026 09:30:54 GMT https://vulnogram.org/CVE-2026-112068 https://vulnogram.org/CVE-2026-112068 The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site. Medium Tue, 20 Oct 2026 09:30:53 GMT https://vulnogram.org/CVE-2026-112237 https://vulnogram.org/CVE-2026-112237 The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by… Medium Network Exploitable Tue, 20 Oct 2026 09:30:52 GMT https://vulnogram.org/CVE-2026-112240 https://vulnogram.org/CVE-2026-112240 The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by… Medium Network Exploitable Tue, 20 Oct 2026 09:30:51 GMT https://vulnogram.org/CVE-2026-113442 https://vulnogram.org/CVE-2026-113442 Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient. Medium Network Exploitable Tue, 20 Oct 2026 09:30:50 GMT https://vulnogram.org/CVE-2026-112238 https://vulnogram.org/CVE-2026-112238 The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the inten… High Network Exploitable Tue, 20 Oct 2026 09:30:48 GMT https://vulnogram.org/CVE-2026-112071 https://vulnogram.org/CVE-2026-112071 The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that con… Medium Network Exploitable Tue, 20 Oct 2026 09:30:47 GMT https://vulnogram.org/CVE-2026-113468 https://vulnogram.org/CVE-2026-113468 The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary con… Medium Network Exploitable Tue, 20 Oct 2026 09:30:46 GMT https://vulnogram.org/CVE-2026-112239 https://vulnogram.org/CVE-2026-112239 The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore c… High Tue, 20 Oct 2026 09:30:46 GMT https://vulnogram.org/CVE-2026-113459 https://vulnogram.org/CVE-2026-113459 In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at… High Tue, 20 Oct 2026 09:30:44 GMT https://vulnogram.org/CVE-2026-112070 https://vulnogram.org/CVE-2026-112070 The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to. Medium Tue, 20 Oct 2026 09:30:43 GMT https://vulnogram.org/CVE-2026-109162 https://vulnogram.org/CVE-2026-109162 Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly… Medium Network Exploitable Tue, 13 Oct 2026 09:27:24 GMT https://vulnogram.org/CVE-2026-77132 https://vulnogram.org/CVE-2026-77132 It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fa… Medium Tue, 08 Sep 2026 09:18:41 GMT https://vulnogram.org/CVE-2026-85400 https://vulnogram.org/CVE-2026-85400 Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited… High Tue, 08 Sep 2026 09:18:40 GMT https://vulnogram.org/CVE-2026-56092 https://vulnogram.org/CVE-2026-56092 The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-i… High Tue, 25 Aug 2026 09:00:49 GMT https://vulnogram.org/CVE-2026-56093 https://vulnogram.org/CVE-2026-56093 The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents t… Medium Network Exploitable Tue, 25 Aug 2026 09:00:48 GMT https://vulnogram.org/CVE-2026-56094 https://vulnogram.org/CVE-2026-56094 The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr… Medium Network Exploitable Tue, 25 Aug 2026 09:00:48 GMT https://vulnogram.org/CVE-2026-56095 https://vulnogram.org/CVE-2026-56095 The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather… High Tue, 25 Aug 2026 09:00:47 GMT https://vulnogram.org/CVE-2026-56096 https://vulnogram.org/CVE-2026-56096 The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate inde… Medium Network Exploitable Tue, 25 Aug 2026 09:00:46 GMT https://vulnogram.org/CVE-2026-77127 https://vulnogram.org/CVE-2026-77127 The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an e… Medium Tue, 25 Aug 2026 09:00:45 GMT https://vulnogram.org/CVE-2026-77128 https://vulnogram.org/CVE-2026-77128 The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is… Medium Network Exploitable Tue, 25 Aug 2026 09:00:44 GMT https://vulnogram.org/CVE-2026-77129 https://vulnogram.org/CVE-2026-77129 The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disc… High Tue, 25 Aug 2026 09:00:44 GMT https://vulnogram.org/CVE-2026-77130 https://vulnogram.org/CVE-2026-77130 The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY… Medium Tue, 25 Aug 2026 09:00:43 GMT https://vulnogram.org/CVE-2026-77131 https://vulnogram.org/CVE-2026-77131 When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key. Medium Tue, 25 Aug 2026 09:00:42 GMT https://vulnogram.org/CVE-2026-77133 https://vulnogram.org/CVE-2026-77133 The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups. Medium Tue, 25 Aug 2026 09:00:41 GMT https://vulnogram.org/CVE-2026-77134 https://vulnogram.org/CVE-2026-77134 The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-appro… High Network Exploitable Tue, 25 Aug 2026 09:00:40 GMT https://vulnogram.org/CVE-2026-77135 https://vulnogram.org/CVE-2026-77135 The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name,… High Network Exploitable Tue, 25 Aug 2026 09:00:40 GMT https://vulnogram.org/CVE-2026-77136 https://vulnogram.org/CVE-2026-77136 The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid… Critical Network Exploitable Tue, 25 Aug 2026 09:00:39 GMT https://vulnogram.org/CVE-2026-77137 https://vulnogram.org/CVE-2026-77137 The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low… High Tue, 25 Aug 2026 09:00:38 GMT https://vulnogram.org/CVE-2026-77138 https://vulnogram.org/CVE-2026-77138 The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remo… Critical Network Exploitable Tue, 25 Aug 2026 09:00:38 GMT https://vulnogram.org/CVE-2026-77139 https://vulnogram.org/CVE-2026-77139 The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path trav… Medium Tue, 25 Aug 2026 09:00:37 GMT https://vulnogram.org/CVE-2026-77140 https://vulnogram.org/CVE-2026-77140 The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct P… High Network Exploitable Tue, 25 Aug 2026 09:00:36 GMT https://vulnogram.org/CVE-2026-77141 https://vulnogram.org/CVE-2026-77141 The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record ca… High Network Exploitable Tue, 25 Aug 2026 09:00:35 GMT https://vulnogram.org/CVE-2026-77142 https://vulnogram.org/CVE-2026-77142 The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server si… High Network Exploitable Tue, 25 Aug 2026 09:00:35 GMT https://vulnogram.org/CVE-2026-77143 https://vulnogram.org/CVE-2026-77143 The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows the identifier of a topic from the public forum can submit a modified update request for th… High Network Exploitable Tue, 25 Aug 2026 09:00:34 GMT https://vulnogram.org/CVE-2026-77144 https://vulnogram.org/CVE-2026-77144 The frontend management plugin attributed a newly created event to the submitting user's organizer record only when the request supplied no organizer of its own. The accompanying permission check confirmed only that the submitting user held any organ… High Tue, 25 Aug 2026 09:00:33 GMT https://vulnogram.org/CVE-2026-77145 https://vulnogram.org/CVE-2026-77145 The permission check for the frontend management update flow verified a different event than the one the request went on to modify. A user with frontend event management access could therefore modify events belonging to other organizers. High Tue, 25 Aug 2026 09:00:32 GMT https://vulnogram.org/CVE-2026-77146 https://vulnogram.org/CVE-2026-77146 The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary exis… High Network Exploitable Tue, 25 Aug 2026 09:00:31 GMT https://vulnogram.org/CVE-2026-19418 https://vulnogram.org/CVE-2026-19418 The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated t… High Tue, 11 Aug 2026 07:29:37 GMT https://vulnogram.org/CVE-2026-15305 https://vulnogram.org/CVE-2026-15305 Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form buildi… Medium Network Exploitable Tue, 14 Jul 2026 12:45:10 GMT https://vulnogram.org/CVE-2026-49742 https://vulnogram.org/CVE-2026-49742 Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could… High Tue, 09 Jun 2026 10:54:58 GMT https://vulnogram.org/CVE-2026-49741 https://vulnogram.org/CVE-2026-49741 Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed i… High Tue, 09 Jun 2026 10:54:19 GMT https://vulnogram.org/CVE-2026-49740 https://vulnogram.org/CVE-2026-49740 TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend (cache store or sys_regi… Medium Tue, 09 Jun 2026 10:53:55 GMT https://vulnogram.org/CVE-2026-49738 https://vulnogram.org/CVE-2026-49738 The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when t… Low Tue, 09 Jun 2026 10:53:31 GMT https://vulnogram.org/CVE-2026-47352 https://vulnogram.org/CVE-2026-47352 Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10… Medium Tue, 09 Jun 2026 10:53:05 GMT https://vulnogram.org/CVE-2026-47351 https://vulnogram.org/CVE-2026-47351 Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3… Medium Tue, 09 Jun 2026 10:52:38 GMT