DeutschShown in its original language — a full translation is planned for a future version.
TYPO3 Core: Mehrere Schwachstellen
view advisory published 2026-06-08
Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsbeschränkungen zu umgehen, Benutzer auf schädliche Websites umzuleiten, beliebigen Code auszuführen, Berechtigungen zu eskalieren oder andere Auswirkungen zu verursachen.
01
describes (15)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-49742US | — | — | ||
Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback stor… | ||||
| CVE-2026-49741US | —OT elevated | — | ||
Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Fr… | ||||
| CVE-2026-49740US | — | — | ||
TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation or class restrictions. An attacker with w… | ||||
| CVE-2026-49738US | — | — | ||
The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var… | ||||
| CVE-2026-47352US | —OT elevated | — | ||
Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted fi… | ||||
| CVE-2026-47351US | —OT elevated | — | ||
Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about record… | ||||
| CVE-2026-47350US | —OT elevated | — | ||
Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3… | ||||
| CVE-2026-47349US | —OT elevated | — | ||
Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issue affects TYPO3 CMS v… | ||||
| CVE-2026-47348US | — | — | ||
Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in fr… | ||||
| CVE-2026-47347US | — | — | ||
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sa… | ||||
| CVE-2026-47346US | —OT elevated | — | ||
Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction.… | ||||
| CVE-2026-47343US | —OT elevated | — | ||
Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to mis… | ||||
| CVE-2026-11607US | —OT elevated | — | ||
Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extensi… | ||||
| CVE-2026-47345US | — | — | ||
Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-sanitizer before version… | ||||
| CVE-2026-47344US | — | — | ||
When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as valid end tags, allowing… | ||||
02
references
External citations — patches, advisories, analysis.
- Typo3 Core Security Advisory TYPO3-CORE-SA-2026-006 vom 2026-06-08external
- Typo3 Core Security Advisory TYPO3-CORE-SA-2026-007 vom 2026-06-08external
- Typo3 Core Security Advisory TYPO3-CORE-SA-2026-008 vom 2026-06-08external
- Typo3 Core Security Advisory TYPO3-CORE-SA-2026-009 vom 2026-06-08external
- Typo3 Core Security Advisory TYPO3-CORE-SA-2026-010 vom 2026-06-08external
- Typo3 Core Security Advisory TYPO3-CORE-SA-2026-011 vom 2026-06-08external
- Typo3 Core Security Advisory TYPO3-CORE-SA-2026-012 vom 2026-06-08external
- Typo3 Core Security Advisory TYPO3-CORE-SA-2026-013 vom 2026-06-08external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan