PHP package security
Is typo3/cms-core vulnerable?
130 known security advisories for typo3/cms-core. The latest was reported on 2026-08-11 and is fixed in 13.4.34 and 14.3.6. The newest release, 14.3.10, is not affected by any of them.
1 critical 35 high 85 medium 8 low 1 unscored
- Known advisories
- 130
- Newest release
- 14.3.10
- Released
- 2026-10-22
- Affecting newest release
- 0
- Last synced
- 2026-11-03
Check your version
Security advisories for typo3/cms-core
| Reported | Advisory | Severity | Affected | Fixed in |
|---|---|---|---|---|
| 2026-08-11 | TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool CVE-2026-19418 · GitHub, FriendsOfPHP/security-advisories | high | >=13.0.0,<13.4.34 | >=14.0.0,<14.3.6 | 13.4.34, 14.3.6 |
| 2026-06-09 | TYPO3-CORE-SA-2026-019: Broken Access Control in Form Framework CVE-2026-11607 · GitHub, FriendsOfPHP/security-advisories | high | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API CVE-2026-49740 · GitHub, FriendsOfPHP/security-advisories | medium | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-017: Privilege Escalation & SQL Injection in Form Framework CVE-2026-49741 · GitHub, FriendsOfPHP/security-advisories | high | >=14.0.0,<14.3.3 | 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer CVE-2026-49738 · GitHub, FriendsOfPHP/security-advisories | low | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-015: Broken Access Control in Backend API CVE-2026-47352 · GitHub, FriendsOfPHP/security-advisories | medium | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-014: Broken Access Control in Clipboard CVE-2026-47351 · GitHub, FriendsOfPHP/security-advisories | medium | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-013: Broken Access Control in Media Module CVE-2026-49742 · GitHub, FriendsOfPHP/security-advisories | high | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-012: Broken Access Control in DataHandler CVE-2026-47350 · GitHub, FriendsOfPHP/security-advisories | medium | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-011: Broken Access Control in Recycler CVE-2026-47349 · GitHub, FriendsOfPHP/security-advisories | medium | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-010: Cross-Site Scripting in Indexed Search CVE-2026-47348 · GitHub, FriendsOfPHP/security-advisories | medium | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS CVE-2026-47347 · GitHub, FriendsOfPHP/security-advisories | medium | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-008: Broken Access Control in Form Framework CVE-2026-47346 · GitHub, FriendsOfPHP/security-advisories | high | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-06-09 | TYPO3-CORE-SA-2026-007: Broken Access Control in File Abstraction Layer CVE-2026-47343 · GitHub, FriendsOfPHP/security-advisories | high | <10.4.57 | >=11.0.0,<11.5.51 | >=12.0.0,<12.4.46 | >=13.0.0,<13.4.31 | >=14.0.0,<14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3 |
| 2026-01-13 | TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool GHSA-7vp9-x248-9vr9 · CVE-2026-0859 · GitHub | medium | >=10.0.0,<=10.4.54 | >=11.0.0,<=11.5.48 | >=12.0.0,<=12.4.40 | >=13.0.0,<=13.4.22 | >=14.0.0,<=14.0.1 | not stated |
| 2025-09-09 | TYPO3 CMS exposes sensitive information in an error message GHSA-cvm2-5f78-g9m8 · CVE-2025-59016 · GitHub | medium | >=13.0.0,<13.4.18 | >=12.0.0,<12.4.37 | >=11.0.0,<11.5.48 | >=10.0.0,<10.4.54 | >=9.0.0,<9.5.55 | 9.5.55, 10.4.54, 11.5.48, 12.4.37, 13.4.18 |
| 2025-09-09 | TYPO3 CMS uses insufficient entropy when generating passwords GHSA-p5jq-5383-qvc7 · CVE-2025-59015 · GitHub | medium | >=13.0.0,<13.4.18 | >=12.0.0,<12.4.37 | 12.4.37, 13.4.18 |
| 2025-09-09 | TYPO3 CMS has an open‑redirect vulnerability GHSA-72jf-5fg5-3cw3 · CVE-2025-59013 · GitHub | medium | >=13.0.0,<13.4.18 | >=12.0.0,<12.4.37 | >=11.0.0,<11.5.48 | >=10.0.0,<10.4.54 | >=9.0.0,<9.5.55 | 9.5.55, 10.4.54, 11.5.48, 12.4.37, 13.4.18 |
| 2025-05-20 | TYPO3 Allows Privilege Escalation to System Maintainer GHSA-6frx-j292-c844 · CVE-2025-47940 · GitHub | high | >=13.0.0,<=13.4.11 | >=12.0.0,<=12.4.30 | >=11.0.0,<=11.5.43 | >=10.4.0,<=10.4.49 | not stated |
| 2025-05-20 | TYPO3 Allows Unrestricted File Upload in File Abstraction Layer GHSA-9hq9-cr36-4wpj · CVE-2025-47939 · GitHub | medium | >=13.0.0,<=13.4.11 | >=12.0.0,<=12.4.30 | >=11.0.0,<=11.5.43 | >=10.0.0,<=10.4.49 | >=9.0.0,<=9.5.50 | not stated |
| 2025-05-20 | TYPO3 Unverified Password Change for Backend Users GHSA-3jrg-97f3-rqh9 · CVE-2025-47938 · GitHub | low | >=13.0.0,<=13.4.11 | >=12.0.0,<=12.4.30 | >=11.0.0,<=11.5.43 | >=10.0.0,<=10.4.49 | >=9.0.0,<=9.5.50 | not stated |
| 2025-05-20 | TYPO3 Allows Information Disclosure via DBAL Restriction Handling GHSA-x8pv-fgxp-8v3x · CVE-2025-47937 · GitHub | low | >=13.0.0,<=13.4.11 | >=12.0.0,<=12.4.30 | >=11.0.0,<=11.5.43 | >=10.0.0,<=10.4.49 | >=9.0.0,<=9.5.50 | not stated |
| 2025-01-14 | TYPO3 Potential Open Redirect via Parsing Differences GHSA-2fx5-pggv-6jjr · CVE-2024-55892 · GitHub | medium | >=13.0.0,<=13.4.2 | >=12.0.0,<=12.4.24 | >=11.0.0,<=11.5.41 | >=10.0.0,<=10.4.47 | >=9.0.0,<=9.5.48 | not stated |
| 2024-05-30 | TYPO3 Cross-Site Scripting in Form Framework validation handling GHSA-95qm-3xp7-vfj5 · GitHub | medium | >=9.0.0,<9.5.12 | >=8.0.0,<8.7.30 | >=10.0.0,<10.2.1 | 8.7.30, 9.5.12, 10.2.1 |
| 2024-05-14 | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController GHSA-36g8-62qv-5957 · CVE-2024-34358 · GitHub | medium | >=13.0.0,<=13.1.0 | >=12.0.0,<=12.4.14 | >=11.0.0,<=11.5.36 | >=10.0.0,<=10.4.44 | >=9.0.0,<=9.5.47 | not stated |
| 2024-05-14 | TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController GHSA-hw6c-6gwq-3m3m · CVE-2024-34357 · GitHub | medium | >=13.0.0,<=13.1.0 | >=12.0.0,<=12.4.14 | >=11.0.0,<=11.5.36 | >=10.0.0,<=10.4.44 | >=9.0.0,<=9.5.47 | not stated |
| 2024-05-14 | TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module GHSA-v6mw-h7w6-59w3 · CVE-2024-34356 · GitHub | medium | >=13.0.0,<=13.1.0 | >=12.0.0,<=12.4.14 | >=11.0.0,<=11.5.36 | >=10.0.0,<=10.4.44 | >=9.0.0,<=9.5.47 | not stated |
| 2024-05-14 | TYPO3 vulnerable to an HTML Injection in the History Module GHSA-xjwx-78x7-q6jc · CVE-2024-34355 · GitHub | low | >=13.0.0,<=13.1.0 | not stated |
| 2024-02-13 | TYPO3 Install Tool vulnerable to Code Execution GHSA-5w2h-59j3-8x5w · CVE-2024-22188 · GitHub | high | =13.0.0 | >=12.0.0,<=12.4.10 | >=11.0.0,<=11.5.34 | >=10.0.0,<=10.4.42 | >=9.0.0,<=9.5.45 | >=8.0.0,<=8.7.56 | not stated |
| 2024-02-13 | Path Traversal in TYPO3 File Abstraction Layer Storages GHSA-w6x2-jg8h-p6mp · CVE-2023-30451 · GitHub | medium | =13.0.0 | >=12.0.0,<=12.4.10 | >=11.0.0,<=11.5.34 | >=10.0.0,<=10.4.42 | >=9.0.0,<=9.5.45 | >=8.0.0,<=8.7.56 | not stated |
| 2024-02-13 | TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler GHSA-rj3x-wvc6-5j66 · CVE-2024-25121 · GitHub | high | =13.0.0 | >=12.0.0,<=12.4.10 | >=11.0.0,<=11.5.34 | >=10.0.0,<=10.4.42 | >=9.0.0,<=9.5.45 | >=8.0.0,<=8.7.56 | not stated |
| 2024-02-13 | TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme GHSA-wf85-8hx9-gj7c · CVE-2024-25120 · GitHub | medium | =13.0.0 | >=12.0.0,<=12.4.10 | >=11.0.0,<=11.5.34 | >=10.0.0,<=10.4.42 | >=9.0.0,<=9.5.45 | >=8.0.0,<=8.7.56 | not stated |
| 2024-02-13 | TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key GHSA-h47m-3f78-qp9g · CVE-2024-25119 · GitHub | medium | =13.0.0 | >=12.0.0,<=12.4.10 | >=11.0.0,<=11.5.34 | >=10.0.0,<=10.4.42 | >=9.0.0,<=9.5.45 | >=8.0.0,<=8.7.56 | not stated |
| 2024-02-13 | TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords GHSA-38r2-5695-334w · CVE-2024-25118 · GitHub | medium | =13.0.0 | >=12.0.0,<=12.4.10 | >=11.0.0,<=11.5.34 | >=10.0.0,<=10.4.42 | >=9.0.0,<=9.5.45 | >=8.0.0,<=8.7.56 | not stated |
| 2023-11-14 | TYPO3-CORE-SA-2023-006: Weak Authentication in Session Handling CVE-2023-47127 · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.55 | >=9.0.0,<9.5.44 | >=10.0.0,<10.4.41 | >=11.0.0,<11.5.33 | >=12.0.0,<12.4.8 | 8.7.55, 9.5.44, 10.4.41, 11.5.33, 12.4.8 |
| 2023-07-25 | Information Disclosure due to Out-of-scope Site Resolution GHSA-jq6g-4v5m-wm9r · CVE-2023-38499 · GitHub | low | >=12.0.0,<12.4.4 | >=11.0.0,<11.5.30 | >=10.0.0,<10.4.39 | >=9.4.0,<9.5.42 | 9.5.42, 10.4.39, 11.5.30, 12.4.4 |
| 2023-02-07 | TYPO3-CORE-SA-2023-001: Persisted Cross-Site Scripting in Frontend Rendering CVE-2023-24814 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.35 | >=11.0.0,<11.5.23 | >=12.0.0,<12.2.0 | 10.4.35, 11.5.23, 12.2.0 |
| 2022-12-13 | TYPO3-CORE-SA-2022-017: By-passing Cross-Site Scripting Protection in HTML Sanitizer CVE-2022-23499 · FriendsOfPHP/security-advisories | unscored | >=10.0.0,<10.4.33 | >=11.0.0,<11.5.20 | >=12.0.0,<12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| 2022-12-13 | TYPO3-CORE-SA-2022-016: Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration CVE-2022-23504 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.33 | >=11.0.0,<11.5.20 | >=12.0.0,<12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| 2022-12-13 | TYPO3-CORE-SA-2022-015: Arbitrary Code Execution via Form Framework CVE-2022-23503 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.33 | >=11.0.0,<11.5.20 | >=12.0.0,<12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| 2022-12-13 | TYPO3-CORE-SA-2022-014: Insufficient Session Expiration after Password Reset CVE-2022-23502 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.33 | >=11.0.0,<11.5.20 | >=12.0.0,<12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| 2022-12-13 | TYPO3-CORE-SA-2022-013: Weak Authentication in Frontend Login CVE-2022-23501 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.33 | >=11.0.0,<11.5.20 | >=12.0.0,<12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| 2022-12-13 | TYPO3-CORE-SA-2022-012: Denial of Service in Page Error Handling CVE-2022-23500 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.33 | >=11.0.0,<11.5.20 | 10.4.33, 11.5.20 |
| 2022-09-13 | TYPO3-CORE-SA-2022-006: Denial of Service in Page Error Handling CVE-2022-36104 · GitHub, FriendsOfPHP/security-advisories | medium | >=11.0.0,<11.5.16 | 11.5.16 |
| 2022-09-13 | TYPO3-CORE-SA-2022-011: By-passing Cross-Site Scripting Protection in HTML Sanitizer CVE-2022-36020 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.32 | >=11.0.0,<11.5.16 | 10.4.32, 11.5.16 |
| 2022-09-13 | TYPO3-CORE-SA-2022-010: Cross-Site Scripting in <f:asset.css> view helper CVE-2022-36108 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.32 | >=11.0.0,<11.5.16 | 10.4.32, 11.5.16 |
| 2022-09-13 | TYPO3-CORE-SA-2022-009: Stored Cross-Site Scripting via FileDumpController CVE-2022-36107 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.32 | >=11.0.0,<11.5.16 | 10.4.32, 11.5.16 |
| 2022-09-13 | TYPO3-CORE-SA-2022-008: Missing check for expiration time of password reset token for backend users CVE-2022-36106 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.32 | >=11.0.0,<11.5.16 | 10.4.32, 11.5.16 |
| 2022-09-13 | TYPO3-CORE-SA-2022-007: User Enumeration via Response Timing CVE-2022-36105 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.32 | >=11.0.0,<11.5.16 | 10.4.32, 11.5.16 |
| 2022-06-14 | TYPO3-CORE-SA-2022-005: Insufficient Session Expiration in Admin Tool CVE-2022-31050 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.29 | >=11.0.0,<11.5.11 | 10.4.29, 11.5.11 |
| 2022-06-14 | TYPO3-CORE-SA-2022-004: Cross-Site Scripting in Frontend Login Mailer CVE-2022-31049 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.29 | >=11.0.0,<11.5.11 | 10.4.29, 11.5.11 |
| 2022-06-14 | TYPO3-CORE-SA-2022-003: Cross-Site Scripting in Form Framework CVE-2022-31048 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.29 | >=11.0.0,<11.5.11 | 10.4.29, 11.5.11 |
| 2022-06-14 | TYPO3-CORE-SA-2022-002: Information Disclosure via Exception Handling/Logger CVE-2022-31047 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.29 | >=11.0.0,<11.5.11 | 10.4.29, 11.5.11 |
| 2022-06-14 | TYPO3-CORE-SA-2022-001: Information Disclosure via Export Module CVE-2022-31046 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.29 | >=11.0.0,<11.5.11 | 10.4.29, 11.5.11 |
| 2022-05-17 | TYPO3 SQL injection vulnerability in the Extbase Framework GHSA-m64j-j252-jxmr · CVE-2013-1842 · GitHub | high | >=6.0.0,<6.0.3 | >=4.7.0,<4.7.9 | >=4.6.0,<4.6.17 | >=4.5.0,<=4.5.23 | 4.6.17, 4.7.9, 6.0.3 |
| 2022-05-17 | TYPO3 Open redirect vulnerability in the Access tracking mechanism GHSA-7gxq-5qqc-v3fc · CVE-2013-1843 · GitHub | medium | >=6.0.0,<6.0.3 | >=4.7.0,<4.7.9 | >=4.6.0,<4.6.17 | >=4.5.0,<4.5.24 | 4.5.24, 4.6.17, 4.7.9, 6.0.3 |
| 2022-05-17 | TYPO3 is vulnerable to Mass Assignment in the Extension table administration library GHSA-5fj8-wh3g-qvq2 · CVE-2013-7080 · GitHub | medium | >=6.0.0,<6.0.11 | >=4.6.0,<4.7.16 | >=4.5.0,<4.5.31 | 4.5.31, 4.7.16, 6.0.11 |
| 2022-05-17 | TYPO3 Improper Access Control vulnerability GHSA-r674-mc9p-hvw5 · CVE-2013-7081 · GitHub | medium | >=6.1.0,<6.1.6 | >=6.0.0,<6.0.11 | >=4.7.0,<4.7.16 | >=4.5.0,<4.5.31 | 4.5.31, 4.7.16, 6.0.11, 6.1.6 |
| 2022-05-17 | TYPO3 Improper Access Management in the File Abstraction Layer GHSA-p9jg-9w87-6rg4 · CVE-2013-4320 · GitHub | medium | >=6.1,<6.1.4 | >=6.0,<6.0.9 | 6.0.9, 6.1.4 |
| 2022-05-17 | TYPO3 Sensitive Information Disclosure via escapeStrForLike method GHSA-xgc2-q928-27wv · CVE-2010-5104 · GitHub | medium | >=4.4.0,<4.4.5 | >=4.3.0,<4.3.9 | >=4.2.0,<4.2.16 | 4.2.16, 4.3.9, 4.4.5 |
| 2022-05-17 | TYPO3 Cross-site scripting (XSS) vulnerability in the Extbase Framework GHSA-qj69-chjp-g4f5 · CVE-2013-7078 · GitHub | low | >=6.0.0,<6.0.11 | >=6.1.0,<6.1.6 | >=4.7.0,<4.7.16 | >=4.5.0,<4.5.31 | 4.5.31, 4.7.16, 6.0.11, 6.1.6 |
| 2022-05-17 | TYPO3 Cross-site scripting (XSS) vulnerability in the Backend User Administration Module GHSA-5cmc-r23m-hvrr · CVE-2013-7077 · GitHub | medium | >=6.1,<6.1.7 | >=6.0,<6.0.12 | 6.0.12, 6.1.7 |
| 2022-05-02 | TYPO3 API function vulnerable to Cross-site Scripting GHSA-m7rg-85g8-28m9 · CVE-2009-3633 · GitHub | medium | >=4.3alpha1,<4.3beta2 | >=4.2.0,<4.2.10 | >=4.1.0,<4.1.13 | <=4.0.13 | 4.1.13, 4.2.10, 4.3beta2 |
| 2022-05-01 | TYPO3 Unrestricted File Upload vulnerability GHSA-f35p-hcwf-9f9f · CVE-2008-2717 · GitHub | medium | >=4.2.0,<4.2.1 | >=4.1.0,<4.1.7 | >=4.0.0,<4.0.9 | 4.0.9, 4.1.7, 4.2.1 |
| 2022-04-21 | TYPO3 is vulnerable to Information Disclosure in the HTML mailing API GHSA-5f2f-hr23-j59j · CVE-2010-3673 · GitHub | medium | >=4.4,<4.4.1 | >=4.3,<4.3.4 | <4.2.13 | 4.2.13, 4.3.4, 4.4.1 |
| 2021-10-05 | TYPO3-CORE-SA-2021-015: HTTP Host Header Injection in Request Handling CVE-2021-41114 · GitHub, FriendsOfPHP/security-advisories | medium | >=11.0.0,<11.5.0 | 11.5.0 |
| 2021-10-05 | TYPO3-CORE-SA-2021-014: Cross-Site-Request-Forgery in Backend URI Handling CVE-2021-41113 · GitHub, FriendsOfPHP/security-advisories | high | >=11.2.0,<11.5.0 | 11.5.0 |
| 2021-08-10 | TYPO3-CORE-SA-2021-013: Cross-Site Scripting via Rich-Text Content CVE-2021-32768 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.19 | >=11.0.0,<11.3.2 | >=9.0.0,<9.5.29 | 9.5.29, 10.4.19, 11.3.2 |
| 2021-07-20 | TYPO3-CORE-SA-2021-012: Information Disclosure in User Authentication CVE-2021-32767 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.18 | >=11.0.0,<11.3.1 | >=9.0.0,<9.5.28 | 9.5.28, 10.4.18, 11.3.1 |
| 2021-07-20 | TYPO3-CORE-SA-2021-011: Cross-Site Scripting in Backend Grid View CVE-2021-32669 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.18 | >=11.0.0,<11.3.1 | >=9.0.0,<9.5.28 | 9.5.28, 10.4.18, 11.3.1 |
| 2021-07-20 | TYPO3-CORE-SA-2021-010: Cross-Site Scripting in Query Generator & Query View CVE-2021-32668 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.18 | >=11.0.0,<11.3.1 | >=9.0.0,<9.5.28 | 9.5.28, 10.4.18, 11.3.1 |
| 2021-07-20 | TYPO3-CORE-SA-2021-009: Cross-Site Scripting in Page Preview CVE-2021-32667 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.18 | >=11.0.0,<11.3.1 | >=9.0.0,<9.5.28 | 9.5.28, 10.4.18, 11.3.1 |
| 2021-03-16 | TYPO3-CORE-SA-2021-007: Cross-Site Scripting in Content Preview CVE-2021-21340 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.14 | >=11.0.0,<11.1.1 | 10.4.14, 11.1.1 |
| 2021-03-16 | TYPO3-CORE-SA-2021-004: Cross-Site Scripting in Form Framework CVE-2021-21358 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.14 | >=11.0.0,<11.1.1 | 10.4.14, 11.1.1 |
| 2021-03-16 | TYPO3-CORE-SA-2021-008: Cross-Site Scripting in Content Preview CVE-2021-21370 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.14 | >=11.0.0,<11.1.1 | >=9.0.0,<9.5.25 | 9.5.25, 10.4.14, 11.1.1 |
| 2021-03-16 | TYPO3-CORE-SA-2021-006: Cleartext storage of session identifier CVE-2021-21339 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.14 | >=11.0.0,<11.1.1 | >=9.0.0,<9.5.25 | 9.5.25, 10.4.14, 11.1.1 |
| 2021-03-16 | TYPO3-CORE-SA-2021-005: Denial of Service in Page Error Handling CVE-2021-21359 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.14 | >=11.0.0,<11.1.1 | >=9.0.0,<9.5.25 | 9.5.25, 10.4.14, 11.1.1 |
| 2021-03-16 | TYPO3-CORE-SA-2021-003: Broken Access Control in Form Framework CVE-2021-21357 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.14 | >=11.0.0,<11.1.1 | >=9.0.0,<9.5.25 | 9.5.25, 10.4.14, 11.1.1 |
| 2021-03-16 | TYPO3-CORE-SA-2021-002: Unrestricted File Upload in Form Framework CVE-2021-21355 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.14 | >=11.0.0,<11.1.1 | >=9.0.0,<9.5.25 | 9.5.25, 10.4.14, 11.1.1 |
| 2021-03-16 | TYPO3-CORE-SA-2021-001: Open Redirection in Login Handling CVE-2021-21338 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.14 | >=11.0.0,<11.1.1 | >=9.0.0,<9.5.25 | 9.5.25, 10.4.14, 11.1.1 |
| 2020-11-17 | TYPO3-CORE-SA-2020-012: XML External Entity in Dashboard Widget CVE-2020-26229 · GitHub, FriendsOfPHP/security-advisories | low | >=10.0.0,<10.4.10 | 10.4.10 |
| 2020-11-17 | TYPO3-CORE-SA-2020-011: Cleartext storage of session identifier CVE-2020-26228 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.10 | >=9.0.0,<9.5.23 | >=8.7.0,<8.7.38 | 8.7.38, 9.5.23, 10.4.10 |
| 2020-11-17 | TYPO3-CORE-SA-2020-010: Cross-Site Scripting in Fluid view helpers CVE-2020-26227 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.10 | >=9.0.0,<9.5.23 | >=8.7.0,<8.7.38 | 8.7.38, 9.5.23, 10.4.10 |
| 2020-07-28 | TYPO3-CORE-SA-2020-008: Sensitive Information Disclosure CVE-2020-15098 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.6 | >=9.0.0,<9.5.20 | 9.5.20, 10.4.6 |
| 2020-07-28 | TYPO3-CORE-SA-2020-007: Potential Privilege Escalation CVE-2020-15099 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.6 | >=9.0.0,<9.5.20 | 9.5.20, 10.4.6 |
| 2020-05-12 | TYPO3-CORE-SA-2020-001: Information Disclosure in Password Reset CVE-2020-11063 · GitHub, FriendsOfPHP/security-advisories | low | >=10.0.0,<10.4.2 | 10.4.2 |
| 2020-05-12 | TYPO3-CORE-SA-2020-006: Same-Site Request Forgery to Backend User Interface CVE-2020-11069 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.2 | >=9.0.0,<9.5.17 | 9.5.17, 10.4.2 |
| 2020-05-12 | TYPO3-CORE-SA-2020-005: Insecure Deserialization in Backend User Settings CVE-2020-11067 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.2 | >=9.0.0,<9.5.17 | 9.5.17, 10.4.2 |
| 2020-05-12 | TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized CVE-2020-11066 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.4.2 | >=9.0.0,<9.5.17 | 9.5.17, 10.4.2 |
| 2020-05-12 | TYPO3-CORE-SA-2020-003: Cross-Site Scripting in Link Handling CVE-2020-11065 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.2 | >=9.0.0,<9.5.17 | 9.5.17, 10.4.2 |
| 2020-05-12 | TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form Engine CVE-2020-11064 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.4.2 | >=9.0.0,<9.5.17 | 9.5.17, 10.4.2 |
| 2019-12-17 | Insecure Deserialization in Query Generator & Query View CVE-2019-19849 · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.2.1 | >=8.0.0,<8.7.30 | >=9.0.0,<9.5.12 | 8.7.30, 9.5.12, 10.2.1 |
| 2019-12-17 | SQL Injection in low-level Query Generator CVE-2019-19850 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.2.1 | >=8.0.0,<8.7.30 | >=9.0.0,<9.5.12 | 8.7.30, 9.5.12, 10.2.1 |
| 2019-12-17 | Directory Traversal on ZIP extraction CVE-2019-19848 · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.2.1 | >=8.0.0,<8.7.30 | >=9.0.0,<9.5.12 | 8.7.30, 9.5.12, 10.2.1 |
| 2019-12-17 | Possible Insecure Deserialization in Extbase Request Handling Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=8.0.0,<8.7.30 | >=9.0.0,<9.5.12 | 8.7.30, 9.5.12 |
| 2019-12-17 | Cross-Site Scripting in Filelist Module Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.2.1 | >=8.0.0,<8.7.30 | >=9.0.0,<9.5.12 | 8.7.30, 9.5.12, 10.2.1 |
| 2019-12-17 | Cross-Site Scripting in Form Framework validation handling Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=10.0.0,<10.2.1 | >=8.0.0,<8.7.30 | >=9.0.0,<9.5.12 | 8.7.30, 9.5.12, 10.2.1 |
| 2019-12-17 | Cross-Site Scripting in Link Handling Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=10.0.0,<10.2.1 | >=8.0.0,<8.7.30 | >=9.0.0,<9.5.12 | 8.7.30, 9.5.12, 10.2.1 |
| 2019-06-25 | Possible deserialization side-effects in symfony/cache CVE-2019-10912 · GitHub, FriendsOfPHP/security-advisories | high | >=9.0.0,<9.5.8 | 9.5.8 |
| 2019-06-25 | Insecure Deserialization in TYPO3 CMS CVE-2019-12747 · GitHub, FriendsOfPHP/security-advisories | high | >=8.0.0,<8.7.27 | >=9.0.0,<9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25 | Cross-Site Scripting in Link Handling CVE-2019-12748 · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.27 | >=9.0.0,<9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25 | Information Disclosure in Backend User Interface Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=8.0.0,<8.7.27 | >=9.0.0,<9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25 | Security Misconfiguration in Frontend Session Handling Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=8.0.0,<8.7.27 | >=9.0.0,<9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25 | Broken Access Control in Import Module Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=9.0.0,<9.5.8 | 9.5.8 |
| 2019-06-25 | Arbitrary Code Execution and Cross-Site Scripting in Backend API Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.27 | >=9.0.0,<9.5.8 | 8.7.27, 9.5.8 |
| 2019-05-07 | Possible Arbitrary Code Execution in Image Processing CVE-2019-11832 · GitHub, FriendsOfPHP/security-advisories | high | >=8.0.0,<8.7.25 | >=9.0.0,<9.5.6 | 8.7.25, 9.5.6 |
| 2019-05-07 | Cross-Site Scripting in Fluid Engine CVE-2020-15241 · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.25 | >=9.0.0,<9.5.6 | 8.7.25, 9.5.6 |
| 2019-05-07 | Information Disclosure in User Authentication Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=9.0.0,<9.5.6 | 9.5.6 |
| 2019-05-07 | Security Misconfiguration in User Session Handling Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.25 | >=9.0.0,<9.5.6 | 8.7.25, 9.5.6 |
| 2019-05-07 | Information Disclosure in Page Tree Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=9.0.0,<9.5.6 | 9.5.6 |
| 2019-01-22 | Cross-Site Scripting in Bootstrap CSS toolkit CVE-2018-14041 · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.23 | >=9.0.0,<9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22 | Cross-Site Scripting in Language Pack Handling Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=9.0.0,<9.5.4 | 9.5.4 |
| 2019-01-22 | Broken Access Control in Localization Handling Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.23 | 8.7.23 |
| 2019-01-22 | Information Disclosure of Installed Extensions Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.23 | >=9.0.0,<9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22 | Security Misconfiguration for Backend User Accounts Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=8.0.0,<8.7.23 | >=9.0.0,<9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22 | Arbitrary Code Execution via File List Module Advisory · GitHub, FriendsOfPHP/security-advisories | critical | >=8.0.0,<8.7.23 | >=9.0.0,<9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22 | Cross-Site Scripting in Fluid ViewHelpers Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.23 | >=9.0.0,<9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22 | Cross-Site Scripting in Form Framework Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.23 | >=9.0.0,<9.5.4 | 8.7.23, 9.5.4 |
| 2018-12-11 | Cross-Site Scripting in CKEditor CVE-2018-17960 · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.21 | >=9.0.0,<9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11 | Cross-Site Scripting in Backend Modal Component Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=8.0.0,<8.7.21 | >=9.0.0,<9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11 | Information Disclosure in Install Tool Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.21 | >=9.0.0,<9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11 | Denial of Service in Online Media Asset Handling Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.21 | >=9.0.0,<9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11 | Cross-Site Scripting in Online Media Asset Rendering Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.21 | >=9.0.0,<9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11 | Denial of Service in Frontend Record Registration Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.21 | 8.7.21 |
| 2018-12-11 | Cross-Site Scripting in Frontend User Login Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=8.0.0,<8.7.21 | >=9.0.0,<9.5.2 | 8.7.21, 9.5.2 |
| 2018-12-11 | Security Misconfiguration in Install Tool Cookie Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.21 | >=9.0.0,<9.5.2 | 8.7.21, 9.5.2 |
| 2018-07-12 | Insecure Deserialization in TYPO3 CMS Advisory · GitHub, FriendsOfPHP/security-advisories | high | >=8.5.0,<8.7.17 | >=9.0.0,<9.3.2 | 8.7.17, 9.3.2 |
| 2018-07-12 | Privilege Escalation & SQL Injection in TYPO3 CMS Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.5.0,<8.7.17 | >=9.0.0,<9.3.2 | 8.7.17, 9.3.2 |
| 2018-07-12 | Authentication Bypass in TYPO3 CMS Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.17 | >=9.0.0,<9.3.2 | 8.7.17, 9.3.2 |
| 2018-07-12 | Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS Advisory · GitHub, FriendsOfPHP/security-advisories | medium | >=8.0.0,<8.7.17 | >=9.0.0,<9.3.2 | 8.7.17, 9.3.2 |
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixCheck your whole project. Paste your composer.lock and see every installed package with a known advisory. Nothing is stored.
Check composer.lockQuestions about typo3/cms-core
Does typo3/cms-core have known vulnerabilities?
Yes. Packagist lists 130 security advisories for typo3/cms-core (1 critical, 35 high, 85 medium, 8 low severity). The most recent, reported 2026-08-11, is "TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool". The newest release, 14.3.10, is outside every affected range.
Which version of typo3/cms-core should I run?
The newest stable release is 14.3.10 (published 2026-10-22). The most recent advisory is fixed in 13.4.34 and 14.3.6, so stay on or above the fixed version for your major version. Run composer update typo3/cms-core, then composer audit to confirm nothing else is flagged.
How do I check if my typo3/cms-core version is affected?
Run composer show typo3/cms-core in your project to see the installed version, then enter it in the version check on this page. You can also run composer audit, which reads the same Packagist advisory data for every package in your composer.lock.