Vulnerability-Lookup

WID-SEC-W-2026-1835

Vulnerability from csaf_certbund - Published: 2026-06-08 22:00 - Updated: 2026-06-09 22:00

Summary

TYPO3 Core: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff: Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsbeschränkungen zu umgehen, Benutzer auf schädliche Websites umzuleiten, beliebigen Code auszuführen, Berechtigungen zu eskalieren oder andere Auswirkungen zu verursachen.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2026-11607

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47343

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47344

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47345

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47346

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47347

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47348

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47349

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47350

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47351

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-47352

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-49738

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-49740

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-49741

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

CVE-2026-49742

Affected products

Known affected 5 products

Product	Identifier	Version	Remediation
TYPO3 Core <14.3.3 LTS TYPO3 / Core		<14.3.3 LTS
TYPO3 Core <13.4.31 LTS TYPO3 / Core		<13.4.31 LTS
TYPO3 Core <12.4.46 ELTS TYPO3 / Core		<12.4.46 ELTS
TYPO3 Core <11.5.51 ELTS TYPO3 / Core		<11.5.51 ELTS
TYPO3 Core <10.4.57 ELTS TYPO3 / Core		<10.4.57 ELTS

References

16 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external
https://typo3.org/security/advisory/typo3-core-sa…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsbeschr\u00e4nkungen zu umgehen, Benutzer auf sch\u00e4dliche Websites umzuleiten, beliebigen Code auszuf\u00fchren, Berechtigungen zu eskalieren oder andere Auswirkungen zu verursachen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1835 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1835.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1835 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1835"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-006 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-006"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-007 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-007"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-008 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-008"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-009 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-009"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-010 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-010"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-011 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-011"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-012 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-012"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-013 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-013"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-014 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-014"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-015 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-015"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-016 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-016"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-018 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-018"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-019 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-019"
      },
      {
        "category": "external",
        "summary": "Typo3 Core Security Advisory TYPO3-CORE-SA-2026-017 vom 2026-06-08",
        "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-017"
      }
    ],
    "source_lang": "en-US",
    "title": "TYPO3 Core: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-06-09T22:00:00.000+00:00",
      "generator": {
        "date": "2026-06-10T07:21:10.007+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1835",
      "initial_release_date": "2026-06-08T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-06-08T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-06-09T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: CVE-2026-47351, EUVD-2026-35398, EUVD-2026-35396, EUVD-2026-35395, EUVD-2026-35394, EUVD-2026-35393, EUVD-2026-35392, EUVD-2026-35391, EUVD-2026-35403, EUVD-2026-35402, EUVD-2026-35400, EUVD-2026-35399, EUVD-2026-35397, EUVD-2026-35401"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c10.4.57 ELTS",
                "product": {
                  "name": "TYPO3 Core \u003c10.4.57 ELTS",
                  "product_id": "T055074"
                }
              },
              {
                "category": "product_version",
                "name": "10.4.57 ELTS",
                "product": {
                  "name": "TYPO3 Core 10.4.57 ELTS",
                  "product_id": "T055074-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:10.4.57_elts"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c11.5.51 ELTS",
                "product": {
                  "name": "TYPO3 Core \u003c11.5.51 ELTS",
                  "product_id": "T055076"
                }
              },
              {
                "category": "product_version",
                "name": "11.5.51 ELTS",
                "product": {
                  "name": "TYPO3 Core 11.5.51 ELTS",
                  "product_id": "T055076-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:11.5.51_elts"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c12.4.46 ELTS",
                "product": {
                  "name": "TYPO3 Core \u003c12.4.46 ELTS",
                  "product_id": "T055077"
                }
              },
              {
                "category": "product_version",
                "name": "12.4.46 ELTS",
                "product": {
                  "name": "TYPO3 Core 12.4.46 ELTS",
                  "product_id": "T055077-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:12.4.46_elts"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c13.4.31 LTS",
                "product": {
                  "name": "TYPO3 Core \u003c13.4.31 LTS",
                  "product_id": "T055078"
                }
              },
              {
                "category": "product_version",
                "name": "13.4.31 LTS",
                "product": {
                  "name": "TYPO3 Core 13.4.31 LTS",
                  "product_id": "T055078-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:13.4.31_lts"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c14.3.3 LTS",
                "product": {
                  "name": "TYPO3 Core \u003c14.3.3 LTS",
                  "product_id": "T055079"
                }
              },
              {
                "category": "product_version",
                "name": "14.3.3 LTS",
                "product": {
                  "name": "TYPO3 Core 14.3.3 LTS",
                  "product_id": "T055079-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3:14.3.3_lts"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Core"
          }
        ],
        "category": "vendor",
        "name": "TYPO3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-11607",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-11607"
    },
    {
      "cve": "CVE-2026-47343",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47343"
    },
    {
      "cve": "CVE-2026-47344",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47344"
    },
    {
      "cve": "CVE-2026-47345",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47345"
    },
    {
      "cve": "CVE-2026-47346",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47346"
    },
    {
      "cve": "CVE-2026-47347",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47347"
    },
    {
      "cve": "CVE-2026-47348",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47348"
    },
    {
      "cve": "CVE-2026-47349",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47349"
    },
    {
      "cve": "CVE-2026-47350",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47350"
    },
    {
      "cve": "CVE-2026-47351",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47351"
    },
    {
      "cve": "CVE-2026-47352",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-47352"
    },
    {
      "cve": "CVE-2026-49738",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-49738"
    },
    {
      "cve": "CVE-2026-49740",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-49740"
    },
    {
      "cve": "CVE-2026-49741",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-49741"
    },
    {
      "cve": "CVE-2026-49742",
      "product_status": {
        "known_affected": [
          "T055079",
          "T055078",
          "T055077",
          "T055076",
          "T055074"
        ]
      },
      "release_date": "2026-06-08T22:00:00.000+00:00",
      "title": "CVE-2026-49742"
    }
  ]
}

CVE-2026-11607 (GCVE-0-2026-11607)

Vulnerability from cvelistv5 – Published: 2026-06-09 10:48 – Updated: 2026-06-11 13:24

Title

TYPO3 CMS - Broken Access Control in Form Framework

Summary

Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

TYPO3

References

3 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/typo3/commit/50974c658f6…	patch
https://github.com/TYPO3/typo3/commit/040d50d082a…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	TYPO3 CMS	Affected: 0 , < 10.4.57 (semver) Affected: 11.0.0 , < 11.5.51 (semver) Affected: 12.0.0 , < 12.4.46 (semver) Affected: 13.0.0 , < 13.4.31 (semver) Affected: 14.0.0 , < 14.3.3 (semver)

Credits

Ethan Oliver Hader

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11607",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T12:53:44.766969Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T12:53:55.463Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Form"
          ],
          "packageName": "typo3/cms-form",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "10.4.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.51",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.46",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.4.31",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.4.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.5.51",
                  "versionStartIncluding": "11.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.4.46",
                  "versionStartIncluding": "12.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.31",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.3",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ethan"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Oliver Hader"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Backend users with access to the Form Framework were able to use files not ending in \u003ccode\u003e.form.yaml\u003c/code\u003e as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3."
            }
          ],
          "value": "Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T13:24:45.735Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-019"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/50974c658f647f1aece347b5d6d5acc3c87f2dca"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/040d50d082a01f9e8bd113effd91290a9bb3b69e"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Broken Access Control in Form Framework",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-11607",
    "datePublished": "2026-06-09T10:48:42.477Z",
    "dateReserved": "2026-06-08T15:41:55.470Z",
    "dateUpdated": "2026-06-11T13:24:45.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47343 (GCVE-0-2026-47343)

Vulnerability from cvelistv5 – Published: 2026-06-09 10:49 – Updated: 2026-06-09 12:53

Title

TYPO3 CMS - Destructive Actions on File Mount Folders

Summary

Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.

Severity

7.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

TYPO3

References

3 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/typo3/commit/504e72470ff…	patch
https://github.com/TYPO3/typo3/commit/ac4125aef8b…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	TYPO3 CMS	Affected: 0 , < 10.4.57 (semver) Affected: 11.0.0 , < 11.5.51 (semver) Affected: 12.0.0 , < 12.4.46 (semver) Affected: 13.0.0 , < 13.4.31 (semver) Affected: 14.0.0 , < 14.3.3 (semver)

Credits

Arne Uplegger Elias Häußler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47343",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T12:53:19.826062Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T12:53:27.239Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "File Abstraction Layer"
          ],
          "packageName": "typo3/cms-core",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "10.4.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.51",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.46",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.4.31",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.4.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.5.51",
                  "versionStartIncluding": "11.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.4.46",
                  "versionStartIncluding": "12.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.31",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.3",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Arne Uplegger"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Elias H\u00e4u\u00dfler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2."
            }
          ],
          "value": "Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T10:49:07.575Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-007"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/504e72470ff72aaf5d2256878bf473747f389798"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/ac4125aef8b9b94528a7f74db2444db57b05a87b"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Destructive Actions on File Mount Folders",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47343",
    "datePublished": "2026-06-09T10:49:07.575Z",
    "dateReserved": "2026-05-19T12:49:25.965Z",
    "dateUpdated": "2026-06-09T12:53:27.239Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47344 (GCVE-0-2026-47344)

Vulnerability from cvelistv5 – Published: 2026-06-08 19:03 – Updated: 2026-06-08 19:50

Title

TYPO3 HTML Sanitizer allows Cross-Site Scripting

Summary

When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Severity

2.1 (Low)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-436 - Interpretation Conflict

Assigner

TYPO3

References

2 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/html-sanitizer/commit/bd…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	HTML Sanitizer	Affected: 0 , < 2.3.2 (semver)

Date Public

2026-06-08 20:00

Credits

IPC Labs Oliver Hader

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47344",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T19:50:27.408977Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T19:50:47.479Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "typo3/html-sanitizer",
          "product": "HTML Sanitizer",
          "repo": "https://github.com/TYPO3/html-sanitizer",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "2.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "IPC Labs"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Oliver Hader"
        }
      ],
      "datePublic": "2026-06-08T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "When \u003ccode\u003eALLOW_INSECURE_RAW_TEXT\u003c/code\u003e is enabled, whitespace-variant closing tags (e.g., \u003ccode\u003e\u0026lt;/style\\t\u0026gt;\u003c/code\u003e) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of \u003ccode\u003etypo3/html-sanitizer\u003c/code\u003e before version 2.3.2."
            }
          ],
          "value": "When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., \u003c/style\\t\u003e) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing subsequent content to escape sanitization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-436",
              "description": "CWE-436 Interpretation Conflict",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T19:03:19.826Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-006"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/html-sanitizer/commit/bd1a88d9b5a5f67f1120ec41084e9c1a0675641c"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 HTML Sanitizer allows Cross-Site Scripting",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47344",
    "datePublished": "2026-06-08T19:03:19.826Z",
    "dateReserved": "2026-05-19T12:49:25.966Z",
    "dateUpdated": "2026-06-08T19:50:47.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47345 (GCVE-0-2026-47345)

Vulnerability from cvelistv5 – Published: 2026-06-08 19:04 – Updated: 2026-06-08 19:49

Title

TYPO3 HTML Sanitizer allows Cross-Site Scripting

Summary

Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

TYPO3

References

2 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/html-sanitizer/commit/8b…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	HTML Sanitizer	Affected: 0 , < 2.3.2 (semver)

Date Public

2026-06-08 20:00

Credits

Doyensec in collaboration with Claude and Anthropic Research Benjamin Franzke

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47345",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-08T19:49:44.787228Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-08T19:49:59.995Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "packageName": "typo3/html-sanitizer",
          "product": "HTML Sanitizer",
          "repo": "https://github.com/TYPO3/html-sanitizer",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "2.3.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:html_sanitizer:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "2.3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Doyensec in collaboration with Claude and Anthropic Research"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benjamin Franzke"
        }
      ],
      "datePublic": "2026-06-08T20:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of \u003ccode\u003etypo3/html-sanitizer\u003c/code\u003e before version 2.3.2."
            }
          ],
          "value": "Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version 2.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-08T19:06:11.091Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-006"
        },
        {
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/html-sanitizer/commit/8b5d0be44ded457ca993ec9ca93d859941c63764"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 HTML Sanitizer allows Cross-Site Scripting",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47345",
    "datePublished": "2026-06-08T19:04:08.337Z",
    "dateReserved": "2026-05-19T12:49:25.966Z",
    "dateUpdated": "2026-06-08T19:49:59.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47346 (GCVE-0-2026-47346)

Vulnerability from cvelistv5 – Published: 2026-06-09 10:50 – Updated: 2026-06-11 13:25

Title

TYPO3 CMS - Broken Access Control in Form Framework

Summary

Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-178 - Improper Handling of Case Sensitivity
CWE-862 - Missing Authorization

Assigner

TYPO3

References

3 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/typo3/commit/2030617e6f2…	patch
https://github.com/TYPO3/typo3/commit/eb2b2251d90…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	TYPO3 CMS	Affected: 0 , < 10.4.57 (semver) Affected: 11.0.0 , < 11.5.51 (semver) Affected: 12.0.0 , < 12.4.46 (semver) Affected: 13.0.0 , < 13.4.31 (semver) Affected: 14.0.0 , < 14.3.3 (semver)

Credits

Alexander Künzl Oliver Hader Benjamin Franzke

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47346",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T12:51:14.282222Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T12:52:49.295Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Form"
          ],
          "packageName": "typo3/cms-form",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "10.4.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.51",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.46",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.4.31",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.4.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.5.51",
                  "versionStartIncluding": "11.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.4.46",
                  "versionStartIncluding": "12.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.31",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.3",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alexander K\u00fcnzl"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Oliver Hader"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benjamin Franzke"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., \u003ccode\u003e.FORM.YAML\u003c/code\u003e) to bypass the Form Framework\u0027s upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2."
            }
          ],
          "value": "Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework\u0027s upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-178",
              "description": "CWE-178 Improper Handling of Case Sensitivity",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T13:25:34.866Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-008"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/2030617e6f273cee7b756c695f0a48a45a31eb47"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/eb2b2251d90339d3ab55df3d4c0378ae0c780b45"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Broken Access Control in Form Framework",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47346",
    "datePublished": "2026-06-09T10:50:21.934Z",
    "dateReserved": "2026-05-19T12:49:25.966Z",
    "dateUpdated": "2026-06-11T13:25:34.866Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47347 (GCVE-0-2026-47347)

Vulnerability from cvelistv5 – Published: 2026-06-09 10:51 – Updated: 2026-06-09 13:53

Title

TYPO3 CMS - Open Redirect in Core Utilities

Summary

Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

TYPO3

References

3 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/typo3/commit/3ffc0835012…	patch
https://github.com/TYPO3/typo3/commit/22c2dd5398e…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	TYPO3 CMS	Affected: 0 , < 10.4.57 (semver) Affected: 11.0.0 , < 11.5.51 (semver) Affected: 12.0.0 , < 12.4.46 (semver) Affected: 13.0.0 , < 13.4.31 (semver) Affected: 14.0.0 , < 14.3.3 (semver)

Credits

Alexandre Romao Benjamin Franzke

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47347",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T13:53:20.540304Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T13:53:41.403Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Core Utilities"
          ],
          "packageName": "typo3/cms-core",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "10.4.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.51",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.46",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.4.31",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.4.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.5.51",
                  "versionStartIncluding": "11.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.4.46",
                  "versionStartIncluding": "12.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.31",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.3",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Alexandre Romao"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Benjamin Franzke"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Applications that use \u003ccode\u003eGeneralUtility::sanitizeLocalUrl\u003c/code\u003e to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2."
            }
          ],
          "value": "Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T10:51:00.283Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-009"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/3ffc0835012c6199db0e1dc4b56a77147d8600e0"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/22c2dd5398ebc4cb7aa4aa37e02cb39181dee0cd"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Open Redirect in Core Utilities",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47347",
    "datePublished": "2026-06-09T10:51:00.283Z",
    "dateReserved": "2026-05-19T12:49:25.966Z",
    "dateUpdated": "2026-06-09T13:53:41.403Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47348 (GCVE-0-2026-47348)

Vulnerability from cvelistv5 – Published: 2026-06-09 10:51 – Updated: 2026-06-11 13:25

Title

TYPO3 CMS - Cross-Site Scripting in Indexed Search

Summary

Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

Severity

5.1 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Assigner

TYPO3

References

3 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/typo3/commit/2e96dd0e9fa…	patch
https://github.com/TYPO3/typo3/commit/8004b91a595…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	TYPO3 CMS	Affected: 13.0.0 , < 13.4.31 (semver) Affected: 14.0.0 , < 14.3.3 (semver)

Credits

Jan Kahmen Sanjay Singh Jhala Oliver Hader

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47348",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T14:27:03.369832Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T14:27:49.563Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Indexed Search"
          ],
          "packageName": "typo3/cms-indexed-search",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "13.4.31",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.31",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.3",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Jan Kahmen"
        },
        {
          "lang": "en",
          "type": "reporter",
          "value": "Sanjay Singh Jhala"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Oliver Hader"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the \u003ccode\u003eIndexed Search\u003c/code\u003e plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2."
            }
          ],
          "value": "Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T13:25:56.545Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-010"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/2e96dd0e9fab7ad877b741fb9f6fc645b4270a3e"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/8004b91a5951cfe01dda8554f77d0daa82d6b899"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Cross-Site Scripting in Indexed Search",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47348",
    "datePublished": "2026-06-09T10:51:29.891Z",
    "dateReserved": "2026-05-19T12:49:25.966Z",
    "dateUpdated": "2026-06-11T13:25:56.545Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47349 (GCVE-0-2026-47349)

Vulnerability from cvelistv5 – Published: 2026-06-09 10:51 – Updated: 2026-06-11 13:26

Title

TYPO3 CMS - Broken Access Control in Recycler

Summary

Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

TYPO3

References

3 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/typo3/commit/9f17a307cf7…	patch
https://github.com/TYPO3/typo3/commit/92f08d8944f…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	TYPO3 CMS	Affected: 0 , < 10.4.57 (semver) Affected: 11.0.0 , < 11.5.51 (semver) Affected: 12.0.0 , < 12.4.46 (semver) Affected: 13.0.0 , < 13.4.31 (semver) Affected: 14.0.0 , < 14.3.3 (semver)

Credits

Hyunseo Shin Elias Häußler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47349",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T13:51:14.013470Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T13:51:28.134Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Recycler"
          ],
          "packageName": "typo3/cms-recycler",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "10.4.57",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.5.51",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.4.46",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.4.31",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.4.57",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "11.5.51",
                  "versionStartIncluding": "11.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "12.4.46",
                  "versionStartIncluding": "12.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.31",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.3",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Hyunseo Shin"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Elias H\u00e4u\u00dfler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Backend users with access to the \u003ccode\u003eRecycler\u003c/code\u003e module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3."
            }
          ],
          "value": "Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T13:26:22.105Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-011"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/9f17a307cf774d63ab8291fc97c6b55653b4265a"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/92f08d8944f1aeccf506fcd323c260448c64d7c8"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Broken Access Control in Recycler",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47349",
    "datePublished": "2026-06-09T10:51:50.281Z",
    "dateReserved": "2026-05-19T12:49:25.966Z",
    "dateUpdated": "2026-06-11T13:26:22.105Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47350 (GCVE-0-2026-47350)

Vulnerability from cvelistv5 – Published: 2026-06-09 10:52 – Updated: 2026-06-09 13:50

Title

TYPO3 CMS - Broken Access Control in DataHandler

Summary

Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.31 and 14.0.0-14.3.3.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization

Assigner

TYPO3

References

3 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/typo3/commit/c9898d2e676…	patch
https://github.com/TYPO3/typo3/commit/195356996a6…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	TYPO3 CMS	Affected: 13.0.0 , < 13.4.31 (semver) Affected: 14.0.0 , < 14.3.3 (semver)

Credits

Hyunseo Shin Torben Hansen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47350",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T13:50:19.531419Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T13:50:29.584Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Core"
          ],
          "packageName": "typo3/cms-core",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "13.4.31",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.31",
                  "versionStartIncluding": "13.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.3",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Hyunseo Shin"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Torben Hansen"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.31 and 14.0.0-14.3.3."
            }
          ],
          "value": "Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.31 and 14.0.0-14.3.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-09T10:52:24.210Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-012"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/c9898d2e67608eda78f8bd1f06ee9cf05a872a56"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/195356996a60e40aeb2cd3e45a5f5c8940d5e116"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Broken Access Control in DataHandler",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47350",
    "datePublished": "2026-06-09T10:52:24.210Z",
    "dateReserved": "2026-05-19T12:49:25.966Z",
    "dateUpdated": "2026-06-09T13:50:29.584Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-47351 (GCVE-0-2026-47351)

Vulnerability from cvelistv5 – Published: 2026-06-09 10:52 – Updated: 2026-06-11 13:26

Title

TYPO3 CMS - Broken Access Control in Clipboard

Summary

Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.

Severity

5.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-862 - Missing Authorization
CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

TYPO3

References

3 references

URL	Tags
https://typo3.org/security/advisory/typo3-core-sa…	vendor-advisory
https://github.com/TYPO3/typo3/commit/932fbb9fcea…	patch
https://github.com/TYPO3/typo3/commit/27407075633…	patch

Impacted products

1 product

Vendor	Product	Version
TYPO3	TYPO3 CMS	Affected: 10.4.0 , < 13.4.31 (semver) Affected: 14.0.0 , < 14.3.3 (semver)

Credits

Vincent Yang Elias Häußler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-47351",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-09T13:47:51.207926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-09T13:50:05.766Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected",
          "modules": [
            "Backend"
          ],
          "packageName": "typo3/cms-backend",
          "product": "TYPO3 CMS",
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "13.4.31",
              "status": "affected",
              "version": "10.4.0",
              "versionType": "semver"
            },
            {
              "lessThan": "14.3.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "13.4.31",
                  "versionStartIncluding": "10.4.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "14.3.3",
                  "versionStartIncluding": "14.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "OR"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Vincent Yang"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Elias H\u00e4u\u00dfler"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2."
            }
          ],
          "value": "Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-11T13:26:46.003Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-014"
        },
        {
          "name": "Git commit of main branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/932fbb9fcea25094e8bcc0f0ec5aab56b1d92451"
        },
        {
          "name": "Git commit of 13.4 branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/TYPO3/typo3/commit/2740707563343d78184c0b7c6303a7484553d7f3"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "TYPO3 CMS - Broken Access Control in Clipboard",
      "x_generator": {
        "engine": "Vulnogram 1.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-47351",
    "datePublished": "2026-06-09T10:52:38.150Z",
    "dateReserved": "2026-05-19T12:49:25.966Z",
    "dateUpdated": "2026-06-11T13:26:46.003Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-1835

CVE-2026-11607 (GCVE-0-2026-11607)

CVE-2026-47343 (GCVE-0-2026-47343)

CVE-2026-47344 (GCVE-0-2026-47344)

CVE-2026-47345 (GCVE-0-2026-47345)

CVE-2026-47346 (GCVE-0-2026-47346)

CVE-2026-47347 (GCVE-0-2026-47347)

CVE-2026-47348 (GCVE-0-2026-47348)

CVE-2026-47349 (GCVE-0-2026-47349)

CVE-2026-47350 (GCVE-0-2026-47350)

CVE-2026-47351 (GCVE-0-2026-47351)

Tags

Sightings

Nomenclature