Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
184 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Failing to properly encode user input, backend forms are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
Recommended action: Upgrade to 8.7.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, several places of the TYPO3 CMS are vulnerable to Cross-Site Scripting.
Recommended action: Upgrade to 8.6.1 or 7.6.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly validate incoming data, the suggest wizard is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
Recommended action: Upgrade to 8.4.1, 7.6.13 or 6.2.29 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Links with a valid cHash argument lead to newly generated page cache entries. Because the cHash is not bound to a specific page, attackers could use valid cHash arguments for multiple pages, leading to additional useless page cache entries. Depending on the number of pages in the system and the number of available valid links with a cHash, attackers could add a considerable amount of additional cache entries, which in the end exceed storage limits and thus could lead to the system not responding any more. This means the Cache Flooding attack potentially could lead to a successful Denial of Service (DoS) attack.
Recommended action: Upgrade to 8.3.1, 7.6.11 or 6.2.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to late TCA initialization the authentication service fails to restrict frontend user according to the validation rules. Therefore it is possible to authenticate restricted (e.g. disabled) frontend users.
Recommended action: Upgrade to 8.6.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that TYPO3’s Salted Password system extension (which is a mandatory system component) is vulnerable to Authentication Bypass when using hashing methods which are related by PHP class inheritance. In standard TYPO3 core distributions stored passwords using the blowfish hashing algorithm can be overridden when using MD5 as the default hashing algorithm by just knowing a valid username. Per default the Portable PHP hashing algorithm (PHPass) is used which is not vulnerable.
Recommended action: Upgrade to 9.3.2, 8.7.17 or 7.6.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly check user permission on file storages, editors could gain knowledge of protected storages and its folders as well as using them in a file collection being rendered in the frontend. A valid backend user account is needed to exploit this vulnerability.
Recommended action: Upgrade to 8.7.5 or 7.6.22 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way, Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability. In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit has been identified so far.
Recommended action: Upgrade to 9.3.2, 8.7.17 or 7.6.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
HTTP requests being performed using the TYPO3 API expose the specific TYPO3 version to the called endpoint.
Recommended action: Upgrade to 8.7.5 or 7.6.22 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly dissociate system related configuration from user generated configuration, the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation. Basically instructions can be persisted to a form definition file that were not configured to be modified - this applies to definitions managed using the form editor module as well as direct file upload using the regular file list module. A valid backend user account as well as having system extension form activated are needed in order to exploit this vulnerability.
Recommended action: Upgrade to 9.3.2 or 8.7.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
TYPO3 uses the package swiftmailer/swiftmailer for mail actions. This package is known to be vulnerable to Remote Code Execution.
Recommended action: Upgrade to 8.5.1, 7.6.15 or 6.2.30 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload .pht files which can be executed in certain web server setups. The new default fileDenyPattern is the following, which might have been overridden in the TYPO3 Install Tool.
Recommended action: Upgrade to 8.7.5 or 7.6.22 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It has been discovered that the Form Framework (system extension "form") is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting "yaml.decodephp" enabled is needed to exploit this vulnerability (which is the default value according to PHP documentation).
Recommended action: Upgrade to 9.3.2 or 8.7.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
All link fields within the TYPO3 installation are vulnerable to Cross-Site Scripting as authorized editors can insert data commands by using the url scheme "data:".
Recommended action: Upgrade to 8.2.1, 7.6.10 or 6.2.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability.
Recommended action: Upgrade to 8.3.1, 7.6.11 or 6.2.27 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Make sure to not expose the vendor directory to the publicly accessible document root. In composer managed installation, make sure to configure a dedicated web folder. In general it is recommended to not expose the complete typo3src sources folder in the document root.
Recommended action: Upgrade to 8.2.1 or 7.6.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames.
Recommended action: Upgrade to 8.2.1, 7.6.10 or 6.2.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly escape user input, the frontend login component is vulnerable to SQL Injection. A valid frontend user account is needed to exploit this vulnerability.
Recommended action: Upgrade to 7.6.10 or 6.2.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Extbase request handling fails to implement a proper access check for requested controller/ action combinations, which makes it possible for an attacker to execute arbitrary Extbase actions by crafting a special request. To successfully exploit this vulnerability, an attacker must have access to at least one Extbase plugin or module action in a TYPO3 installation. The missing access check inevitably leads to information disclosure or remote code execution, depending on the action that an attacker is able to execute.
Recommended action: Upgrade to 8.1.1, 7.6.8 or 6.2.25 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed.
Recommended action: Upgrade to 8.2.1, 7.6.10 or 6.2.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
Recommended action: Upgrade to 8.2.1, 7.6.10 or 6.2.26 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The workspace/ version preview link created by a privileged (backend) user could be abused to obtain certain editing permission, if the admin panel is configured to be shown. A valid preview link is required to exploit this vulnerability.
Recommended action: Upgrade to 8.0.1, 7.6.5 or 6.2.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability.
Recommended action: Upgrade to 8.0.1, 7.6.5 or 6.2.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The default authentication service misses to invalidate empty strings as password. Therefore it is possible to authenticate backend and frontend users without password set in the database. Note: TYPO3 does not allow to create user accounts without a password. Your TYPO3 installation might only be affected if there is a third party component creating user accounts without password by directly manipulating the database.
Recommended action: Upgrade to 8.0.1, 7.6.5 or 6.2.20 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to an oversized maximum result limit, TYPO3 component Indexed Search is susceptible to a Denial of Service attack.
Recommended action: Upgrade to 7.6.4 or 6.2.19 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.