TYPO3

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 8.8HighNov 3, 2026TYPO3 Extension "Frontend User Registration" Auth bypass / access controlCVE-2026-120333The actions linked in the emails of the extension (e.g. to confirm a registration or the deletion of an account) do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrary active frontend users. This allows them to retrieve the email address or username of all frontend users and to delete arbitrary frontend user accounts.
• 5.1MediumNov 3, 2026TYPO3 Extension "Mail" XSSCVE-2026-120332The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
• 5.3MediumNov 3, 2026TYPO3 Extension "Mail" SSRFCVE-2026-120331Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network.
• 7.1HighNov 3, 2026TYPO3 Extension "Mail" Auth bypass / access controlCVE-2026-120330Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients.
• 5.3MediumNov 3, 2026TYPO3 Extension "Mail" Code / command injectionCVE-2026-120329Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig.
• 6.9MediumNov 3, 2026TYPO3 Extension "Mail" Auth bypass / access controlCVE-2026-120328The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails.
• 5.3MediumNov 3, 2026TYPO3 Extension "Mail"CVE-2026-120327The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites.
• 6.9MediumOct 20, 2026Extension "TYPO3 Shop by coding.ms" Auth bypass / access controlCVE-2026-113468The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
• 7.1HighOct 20, 2026Extension "TYPO3 AI Integration Extension" Information disclosureCVE-2026-113459In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expense of the site operator. This only applies if an API key has been configured.
• 5.3MediumOct 20, 2026Extension "TYPO3 Fluid-Form by coding.ms" XSSCVE-2026-113442Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
• 6.3MediumOct 20, 2026Extension "TYPO3 Fluid-Form by coding.ms" Crypto / certificateCVE-2026-112240The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was shown in plain text in the text version of the notification email.
• 7.2HighOct 20, 2026Extension "TYPO3 AI Integration Extension" Auth bypass / access controlCVE-2026-112239The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its access permissions and configuration, outside the scope granted to them.
• 8.7HighOct 20, 2026TYPO3 Extension "File manager" SQL injectionCVE-2026-112238The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.
• 6.9MediumOct 20, 2026TYPO3 Extension "Kitodo.Presentation" SSRFCVE-2026-112237The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requester. An unauthenticated attacker can make the server send requests to arbitrary internal or external hosts. The attacker receives the status code and selected response headers, which allows probing of internal hosts and ports. Response bod
• 6.9MediumOct 20, 2026Extension "TYPO3 Shop by coding.ms" Auth bypass / access controlCVE-2026-112071The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.
• 5.3MediumOct 20, 2026TYPO3 Extension "Analytics" Auth bypass / access controlCVE-2026-112070The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.
• 6.3MediumOct 20, 2026TYPO3 Extension "FAL Protect" Auth bypass / access controlCVE-2026-112069The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
• 5.3MediumOct 20, 2026TYPO3 Extension "Analytics" Auth bypass / access controlCVE-2026-112068The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.
• 6.9MediumOct 20, 2026TYPO3 Extension "Accessible Form Captcha"CVE-2026-112067The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature that causes the answer to be embedded is enabled by default. Forms that rely on the CAPTCHA as their only protection against automated submissions are exposed to abuse by bots.
• 7.1HighOct 20, 2026TYPO3 Extension "sgalinski Cookie Consent" Auth bypass / access controlCVE-2026-112066The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.
• 5.3MediumOct 20, 2026TYPO3 Extension "sgalinski Cookie Consent" Auth bypass / access controlCVE-2026-112065The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site in the installation.
• 7.1HighOct 20, 2026TYPO3 Extension "sgalinski Cookie Consent" SQL injectionCVE-2026-112064The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with access to the history or statistics functions could use this to read arbitrary data from the database, including password hashes of backend and frontend users.
• 6.3MediumOct 13, 2026TYPO3 CMS Path traversal / file handlingCVE-2026-109162Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not af
• 5.3MediumSep 14, 2026TYPO3 content consent Auth bypass / access controlCVE-2023-50462An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direct object reference (IDOR) issue with the potential to expose internal content elements.
• 8.8HighSep 14, 2026TYPO3 direct mail Auth bypass / access controlCVE-2023-50461An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account, with access to the Direct Mail Configuration backend module, is needed to exploit this.
• 5.4MediumSep 14, 2026TYPO3 femanager Auth bypass / access controlCVE-2023-50460An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any frontend user in the system.
• 5.4MediumSep 14, 2026TYPO3 femanager Auth bypass / access controlCVE-2023-50459An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts.
• 4.2MediumSep 14, 2026TYPO3 femanager Auth bypass / access controlCVE-2023-45023The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.
• 7.5HighSep 8, 2026TYPO3 CMS Privilege escalationCVE-2026-85400Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3
• 5.3MediumSep 8, 2026TYPO3 CMS Information disclosureCVE-2026-77132It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting this vulnerability requires a low-privileged backend user account. This issue affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34 and 14.0.0-14.3.6.
• 6.3MediumJul 14, 2026TYPO3 CMSCVE-2026-15305Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.
• 7.5HighApr 21, 2026typo3 Information disclosureCVE-2026-6553Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
• 7.8HighJan 13, 2026typo3 DeserializationCVE-2026-0859TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
• 8.1HighJan 13, 2026typo3 Auth bypass / access controlCVE-2025-59022Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
• 6.4MediumJan 13, 2026typo3 Auth bypass / access controlCVE-2025-59021Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.
• 6.5MediumJan 13, 2026typo3 Auth bypass / access controlCVE-2025-59020By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

See every TYPO3 entry on the dashboard.

Top products

• Extension "Mail"6 CVEs in the last year
• typo35 CVEs in the last year
• TYPO3 CMS4 CVEs in the last year
• femanager3 CVEs in the last year
• Extension "sgalinski Cookie Consent"3 CVEs in the last year
• Extension "TYPO3 Shop by coding.ms"2 CVEs in the last year
• Extension "TYPO3 Fluid-Form by coding.ms"2 CVEs in the last year
• Extension "TYPO3 AI Integration Extension"2 CVEs in the last year
• Extension "Analytics"2 CVEs in the last year
• Extension "Kitodo.Presentation"1 CVE in the last year