Posts by category Public Service Announcement en https://news.typo3.com/article/category/security/public-service-announcement/blog.category.xml Tue, 28 Jul 2026 13:04:24 +0200 https://news.typo3.com/security/advisory/typo3-psa-2025-001https://news.typo3.com/security/advisory/typo3-psa-2025-001#commentsThu, 14 Aug 2025 10:00:00 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2025-001Third-party package enshrined/svg-sanitize, used by TYPO3 core packages, was susceptible to bypassing the sanitization strategy. https://news.typo3.com/security/advisory/typo3-psa-2023-001https://news.typo3.com/security/advisory/typo3-psa-2023-001#commentsMon, 06 Feb 2023 09:00:00 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2023-001The TYPO3 Security Team pre-announces an important security release. https://news.typo3.com/security/advisory/typo3-psa-2022-001https://news.typo3.com/security/advisory/typo3-psa-2022-001#commentsTue, 22 Feb 2022 10:00:00 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2022-001Third-party package enshrined/svg-sanitize, used by TYPO3 core packages, was susceptible to bypassing the sanitization strategy. https://news.typo3.com/security/advisory/typo3-psa-2021-004https://news.typo3.com/security/advisory/typo3-psa-2021-004#commentsThu, 16 Dec 2021 12:01:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-psa-2021-004Components of TYPO3 CMS are based on PHP and are therefore not directly affected by the recent log4j vulnerabilities. However, additional services used in web application scenarios may be affected. https://news.typo3.com/security/advisory/typo3-psa-2021-003https://news.typo3.com/security/advisory/typo3-psa-2021-003#commentsThu, 16 Dec 2021 12:00:00 +0100Marcus Krausehttps://news.typo3.com/security/advisory/typo3-psa-2021-003It has been discovered that TYPO3 CMS is susceptible to cache poisoning. https://news.typo3.com/security/advisory/typo3-psa-2021-002https://news.typo3.com/security/advisory/typo3-psa-2021-002#commentsTue, 20 Jul 2021 11:01:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-psa-2021-002It has been discovered that the TYPO3 extensions offering a CSV export might create CSV files that can contain formulas executed in external applications. https://news.typo3.com/security/advisory/typo3-psa-2021-001https://news.typo3.com/security/advisory/typo3-psa-2021-001#commentsTue, 20 Jul 2021 11:00:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-psa-2021-001It has been discovered that the TYPO3 extension “Indexed Search” may index sensitive links under certain conditions. https://news.typo3.com/security/advisory/typo3-psa-2020-003https://news.typo3.com/security/advisory/typo3-psa-2020-003#commentsTue, 17 Nov 2020 11:11:00 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2020-003Repeating and refining public service announcement TYPO3-PSA-2019-010. https://news.typo3.com/security/advisory/typo3-psa-2020-002https://news.typo3.com/security/advisory/typo3-psa-2020-002#commentsTue, 17 Nov 2020 11:10:00 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2020-002Accessing Install Tool via TYPO3 Backend requires password verification - known as Sudo Mode. https://news.typo3.com/security/advisory/typo3-psa-2020-001https://news.typo3.com/security/advisory/typo3-psa-2020-001#commentsTue, 28 Jul 2020 11:00:00 +0200[No title]https://news.typo3.com/security/advisory/typo3-psa-2020-001It has been discovered that TYPO3 CMS is susceptible to sensitive information disclosure in previous TYPO3 versions which are not maintained by the community anymore. https://news.typo3.com/security/advisory/typo3-psa-2019-011https://news.typo3.com/security/advisory/typo3-psa-2019-011#commentsTue, 17 Dec 2019 09:44:28 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2019-011It has been discovered that TYPO3 CMS can be vulnerable to insecure deserialization. https://news.typo3.com/security/advisory/typo3-psa-2019-010https://news.typo3.com/security/advisory/typo3-psa-2019-010#commentsTue, 17 Dec 2019 09:44:28 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2019-010It has been discovered that TYPO3 is susceptible to cross-site scripting. https://news.typo3.com/security/advisory/typo3-psa-2019-009https://news.typo3.com/security/advisory/typo3-psa-2019-009#commentsWed, 30 Oct 2019 20:00:00 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2019-009It has been discovered that passwords were truncated during authentication process on typo3.org services. https://news.typo3.com/security/advisory/typo3-psa-2019-008https://news.typo3.com/security/advisory/typo3-psa-2019-008#commentsWed, 08 May 2019 09:25:38 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2019-008It has been discovered that the protection against insecure deserialization can be by-passed in Phar Stream Wrapper component. https://news.typo3.com/security/advisory/typo3-psa-2019-007https://news.typo3.com/security/advisory/typo3-psa-2019-007#commentsWed, 08 May 2019 09:04:48 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2019-007It has been discovered that the protection against insecure deserialization can be by-passed in Phar Stream Wrapper component. https://news.typo3.com/security/advisory/typo3-psa-2019-006https://news.typo3.com/security/advisory/typo3-psa-2019-006#commentsTue, 07 May 2019 10:35:34 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2019-006It has been discovered that TYPO3 is susceptible to security misconfiguration. https://news.typo3.com/security/advisory/typo3-psa-2019-005https://news.typo3.com/security/advisory/typo3-psa-2019-005#commentsTue, 07 May 2019 10:32:30 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2019-005It has been discovered that 3rd party library Bootstrap CSS toolkit bundled with TYPO3 is vulnerable to cross-site scripting through prototype pollution. https://news.typo3.com/security/advisory/typo3-psa-2019-004https://news.typo3.com/security/advisory/typo3-psa-2019-004#commentsTue, 07 May 2019 10:25:22 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2019-004It has been discovered that 3rd party library jQuery bundled with TYPO3 is vulnerable to cross-site scripting through prototype pollution. https://news.typo3.com/security/advisory/typo3-psa-2019-001https://news.typo3.com/security/advisory/typo3-psa-2019-001#commentsTue, 22 Jan 2019 10:00:00 +0100[No title]https://news.typo3.com/security/advisory/typo3-psa-2019-001It has been discovered that TYPO3 CMS can be vulnerable to arbitrary code execution. https://news.typo3.com/security/advisory/typo3-psa-2019-002https://news.typo3.com/security/advisory/typo3-psa-2019-002#commentsTue, 22 Jan 2019 10:00:00 +0100[No title]https://news.typo3.com/security/advisory/typo3-psa-2019-002It has been discovered, that usernames and email addresses may be enumerated with brute-force techniques, when using validators in order to ensure a unique username or email address. https://news.typo3.com/security/advisory/typo3-psa-2019-003https://news.typo3.com/security/advisory/typo3-psa-2019-003#commentsTue, 22 Jan 2019 10:00:00 +0100[No title]https://news.typo3.com/security/advisory/typo3-psa-2019-003It has been discovered, that TYPO3 CMS is vulnerable to cross-site scripting. https://news.typo3.com/security/advisory/typo3-psa-2018-002https://news.typo3.com/security/advisory/typo3-psa-2018-002#commentsTue, 20 Nov 2018 11:00:00 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2018-002It has been discovered that development related information can be retrieved by regular HTTP GET requests on NGINX web server environments missing strict access restriction settings. https://news.typo3.com/security/advisory/typo3-psa-2018-001https://news.typo3.com/security/advisory/typo3-psa-2018-001#commentsThu, 18 Oct 2018 10:00:00 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-psa-2018-001It has been discovered that the protection against insecure deserialization can be by-passed in PharStreamWrapper component. https://news.typo3.com/security/advisory/typo3-psa-2017-001https://news.typo3.com/security/advisory/typo3-psa-2017-001#commentsWed, 06 Sep 2017 12:00:00 +0200Thomas Löfflerhttps://news.typo3.com/security/advisory/typo3-psa-2017-001It has been discovered that the TYPO3 Extension Repository (TER) is vulnerable to privilege escalation. https://news.typo3.com/security/advisory/typo3-psa-2016-002https://news.typo3.com/security/advisory/typo3-psa-2016-002#commentsFri, 20 May 2016 11:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-psa-2016-002TYPO3 releases containing a fix for a critical vulnerability will be published Tuesday 24th of May at about 10:00 a.m. CEST (08:00 a.m. GMT). https://news.typo3.com/security/advisory/typo3-psa-2016-001https://news.typo3.com/security/advisory/typo3-psa-2016-001#commentsThu, 05 May 2016 13:00:00 +0200Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-psa-2016-001Multiple vulnerabilities in ImageMagick have been discovered, Remote Code Execution being one of them. https://news.typo3.com/security/advisory/typo3-psa-2015-001https://news.typo3.com/security/advisory/typo3-psa-2015-001#commentsTue, 17 Feb 2015 12:30:00 +0100Helmut Hummelhttps://news.typo3.com/security/advisory/typo3-psa-2015-001A TYPO3 4.5.40 release containing a security fix will be published the day after tomorrow, Thursday 19th of February at about 10:00 am CET. https://news.typo3.com/security/advisory/typo3-psa-2014-001https://news.typo3.com/security/advisory/typo3-psa-2014-001#commentsTue, 28 Jan 2014 14:08:00 +0100[No title]https://news.typo3.com/security/advisory/typo3-psa-2014-001TYPO3 CMS 6.2 will get CSRF Protection throughout all modules and parts that manipulate data.