typo3/cms-backend
[READ-ONLY] Subtree split of the TYPO3 Core Extension "backend"
View on Github
Activity
- Latest release
- Jul 14, 2026
- Total releases
- 267
- Cadence
- ~daily
- Last 12 months
- 37
Reach
- Stars
- 19
Details
- License
- unknown
- First release
- Sep 11, 2017
Releases
| Version | Released | |
|---|---|---|
v14.3.5
patch
| ||
v13.4.33
patch
| ||
v14.3.4
patch
| ||
v13.4.32
patch
| ||
v14.3.3
patch
| ||
v13.4.31
patch
| ||
v14.3.2
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v13.4.30
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v14.3.1
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v13.4.29
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v14.3.0
minor
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v13.4.28
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v12.4.45
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v14.2.0
minor
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-6553
GHSA-xvv6-p4wf-mvx7
Apr 24, 2026
TYPO3 CMS Stores Cleartext Password in User Settings Module
High
Network
Low
None
ProblemThe backend user settings module ( The cleartext data was only persisted if users changed their credentials in the backend user settings module when the TYPO3 14.2.0 release was used (not in any other version). SolutionUpdate to TYPO3 version 14.3.0 LTS which fixes the problem described.
CreditsTYPO3 thanks Martin Clewing for reporting this issue, and TYPO3 core team members Oliver Hader, Stefan Bürk and Garvin Hicking for fixing it. Affected versions
14.2.0
v14.2.0
Fixed in
14.3.0
References Updated May 08, 2026 · Source: OSV.dev | ||
v13.4.27
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v12.4.44
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v14.1.1
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v13.4.26
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v12.4.43
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v13.4.25
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v14.1.0
minor
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v13.4.24
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v12.4.42
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v14.0.2
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v13.4.23
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v12.4.41
patch
2 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev | ||
v13.4.22
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v12.4.40
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v13.4.21
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v14.0.1
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v14.0.0
major
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v13.4.20
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v12.4.39
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v12.4.38
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v13.4.19
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v13.4.18
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v12.4.37
patch
3 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev | ||
v13.4.17
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v12.4.36
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v13.4.16
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v12.4.35
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v13.4.15
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v12.4.34
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v13.4.14
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v12.4.33
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v13.4.13
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v12.4.32
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v13.4.12
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v12.4.31
patch
6 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev | ||
v13.4.11
patch
7 CVEs
CVE-2026-47352
GHSA-2j54-93q2-3hjq
Jun 12, 2026
TYPO3 CMS has Broken Access Control in Backend API
Medium
Network
Low
Low
None
ProblemAuthenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2026-47351
GHSA-q93m-25xv-94hh
Jun 12, 2026
TYPO3 CMS: Broken Access Control in Media Module
Medium
Network
Low
Low
None
ProblemBackend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. SolutionUpdate to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. CreditsTYPO3 CMS thanks Vincent Yang for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. ResourcesAffected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 249 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v8.7.10
v8.7.11
v8.7.12
v8.7.13
v8.7.14
v8.7.15
v8.7.16
v8.7.17
v8.7.18
v8.7.19
v8.7.20
v8.7.21
v8.7.22
v8.7.23
v8.7.24
v8.7.25
v8.7.26
v8.7.27
v8.7.28
v8.7.29
v8.7.30
v8.7.31
v8.7.32
v8.7.7
v8.7.8
v8.7.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.41
v12.4.42
v12.4.43
v12.4.44
v12.4.45
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.0.0
v14.0.1
v14.0.2
v14.1.0
v14.1.1
v14.2.0
v14.3.0
v14.3.1
v14.3.2
Fixed in
10.4.57
11.5.51
12.4.46
13.4.31
14.3.3
References
Updated Jun 12, 2026 · Source: OSV.dev
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
Jan 13, 2026
TYPO3 CMS Allows Broken Access Control in Edit Document Controller
Medium
Network
Low
Low
None
ProblemBy exploiting the SolutionUpdate to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. CreditsThanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ReferencesAffected versions
v14.0.0
v14.0.1
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
+ 162 more Show less
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.37
v12.4.38
v12.4.39
v12.4.4
v12.4.40
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
Fixed in
10.4.55
11.5.49
12.4.41
13.4.23
14.0.2
References
Updated Feb 03, 2026 · Source: OSV.dev
CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
Sep 09, 2025
TYPO3 backend modules have Broken Access Control
Medium
Network
Low
Low
None
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. Affected versions
v10.0.0
v10.1.0
v10.2.0
v10.2.1
v10.2.2
v10.3.0
v10.4.0
v10.4.1
v10.4.10
v10.4.11
v10.4.12
v10.4.13
+ 192 more Show less
v10.4.14
v10.4.15
v10.4.16
v10.4.17
v10.4.18
v10.4.19
v10.4.2
v10.4.20
v10.4.21
v10.4.22
v10.4.23
v10.4.24
v10.4.25
v10.4.26
v10.4.27
v10.4.28
v10.4.29
v10.4.3
v10.4.30
v10.4.31
v10.4.32
v10.4.33
v10.4.34
v10.4.36
v10.4.37
v10.4.4
v10.4.5
v10.4.6
v10.4.7
v10.4.8
v10.4.9
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v9.0.0
v9.1.0
v9.2.0
v9.2.1
v9.3.0
v9.3.1
v9.3.2
v9.3.3
v9.4.0
v9.5.0
v9.5.1
v9.5.10
v9.5.11
v9.5.12
v9.5.13
v9.5.14
v9.5.15
v9.5.16
v9.5.17
v9.5.18
v9.5.19
v9.5.2
v9.5.20
v9.5.21
v9.5.22
v9.5.23
v9.5.24
v9.5.25
v9.5.26
v9.5.27
v9.5.28
v9.5.29
v9.5.3
v9.5.30
v9.5.31
v9.5.4
v9.5.5
v9.5.6
v9.5.7
v9.5.8
v9.5.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References
Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59019
GHSA-j8vm-7q52-2m2m
Sep 09, 2025
TYPO3 CSV download feature information disclosure
Medium
Network
Low
Low
None
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 57 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-59014
GHSA-xrcq-533q-8rxw
Sep 09, 2025
TYPO3 Bookmark Toolbar vulnerable to denial of service
Medium
Network
Low
High
None
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. Affected versions
v11.0.0
v11.1.0
v11.1.1
v11.2.0
v11.3.0
v11.3.1
v11.3.2
v11.3.3
v11.4.0
v11.5.0
v11.5.1
v11.5.10
+ 108 more Show less
v11.5.11
v11.5.12
v11.5.13
v11.5.14
v11.5.15
v11.5.16
v11.5.17
v11.5.18
v11.5.19
v11.5.2
v11.5.20
v11.5.21
v11.5.22
v11.5.23
v11.5.24
v11.5.25
v11.5.26
v11.5.27
v11.5.28
v11.5.29
v11.5.3
v11.5.30
v11.5.31
v11.5.32
v11.5.33
v11.5.34
v11.5.35
v11.5.36
v11.5.37
v11.5.38
v11.5.39
v11.5.4
v11.5.40
v11.5.41
v11.5.5
v11.5.6
v11.5.7
v11.5.8
v11.5.9
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.31
v12.4.32
v12.4.33
v12.4.34
v12.4.35
v12.4.36
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.37
13.4.18
References Updated Sep 09, 2025 · Source: OSV.dev
CVE-2025-47941
GHSA-744g-7qm9-hjh9
May 20, 2025
The TYPO3 CMS Backend has Broken Authentication in Backend MFA
7.2
/ 10
High
Network
Low
High
None
Unchanged
High
High
High
ProblemThe multifactor authentication (MFA) dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful authentication. SolutionUpdate to TYPO3 versions 12.4.31 LTS, 13.4.12 LTS that fix the problem described. CreditsThanks to Jens Jacobsen and Y. Kahveci for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it. Affected versions
v12.0.0
v12.1.0
v12.1.1
v12.1.2
v12.1.3
v12.2.0
v12.3.0
v12.4.0
v12.4.1
v12.4.10
v12.4.11
v12.4.12
+ 45 more Show less
v12.4.13
v12.4.14
v12.4.15
v12.4.16
v12.4.17
v12.4.18
v12.4.19
v12.4.2
v12.4.20
v12.4.21
v12.4.22
v12.4.23
v12.4.24
v12.4.25
v12.4.26
v12.4.27
v12.4.28
v12.4.29
v12.4.3
v12.4.30
v12.4.4
v12.4.5
v12.4.6
v12.4.7
v12.4.8
v12.4.9
v13.0.0
v13.0.1
v13.1.0
v13.1.1
v13.2.1
v13.3.0
v13.3.1
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.2
v13.4.3
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
Fixed in
12.4.31
13.4.12
References Updated May 20, 2025 · Source: OSV.dev |
1–50 of 267