This Month in TYPO3: July, 2026

Alongside that, the Core Team closed a Form Framework upload flaw with 14.3.5 and 13.4.33, and the community-funded Extbase documentation rewrite finally crossed the finish line. August starts in Karlsruhe for T3DD26.

• TYPO3-CORE-SA-2026-020: Unrestricted File Upload in Form Framework — the MimeTypeValidator was registered during form building before the concrete form definition properties were applied, so allowedMimeTypes was never enforced server-side. Rated medium; uploading PHP files was not possible.
• TYPO3 14.3.5 and 13.4.33 security releases published — released 14 July to fix the advisory above. Versions 14.2.0 through 14.3.4 are affected, so if you run the Form Framework with file or image upload elements, this is not an optional update.
• TYPO3 10.4.59, 11.5.53, and 12.4.48 ELTS Released — the matching Extended Long-Term Support builds for v10, v11 and v12 landed the same day. If you are still on an extended-support version, this is your July patch.

61 contributors and 146 reviews made July one of the broader months of the year: 34 patch authors, 8 features, 64 bugfixes, 69 tasks, 16 documentation improvers, and 6,384 words translated in Crowdin. Frank Nägler's recap names all of them.

• New roles and responsibilities in the Association Board — after the 2026 election and its approval by the General Assembly, portfolios were reassigned. Jochen Weiland joined the Board; Rachel Foucard and Boris Hinzer are no longer members.
• Jana Höffner is the Association's new Vice President — not an agency owner, not a developer, but someone who works in the TYPO3 backend every day. She ran on the editor's point of view, a user group that tends to get overlooked in the bigger picture.
• Dialogue Days established common ground for the work ahead — two intensive days in Düsseldorf made shared priorities, concerns, and responsibilities more visible, while deliberately leaving assessment, prioritization, and formal decisions to later stages of the process.
• Future-proofing our governance together — board member Stefan Busemann on how evolving governance can strengthen collaboration, empower contributors, and make the project more transparent, democratic, and scalable.
• The board meeting protocol for 8 July — the Board and BCC followed up on membership exclusions, worked through how AI-generated contributed code should be handled, and updated the Conflict of Interest Matrix for board members.
• The third call for community budget ideas in 2026 — the Association opened its third funding round of the year, continuing the refreshed and more focused approach to backing community-driven and team-driven initiatives.
• State of the TYPO3 Market 2026 — TYPO3 GmbH is gathering input on how sales processes have changed inside agencies. If you sell TYPO3 work, your numbers make the picture more accurate than anyone's guess.
• The Extbase documentation overhaul is complete — Anja Leichsenring delivered the final chapters of the community-funded rewrite on 30 July, closing a project that ran through most of the first half of the year.
• Extbase routing, finally explained — earlier in July the routing chapter for Extbase plugins landed, covering readable, SEO-friendly URLs without the usual guesswork.
• Side-by-side multilingual frontend editing — Visual Editor 1.8.0 lets editors work on several language versions of the same content next to each other in the frontend. Matthias Vogel makes the case that no other CMS has shipped this.
• Ten quotes from UN Open Source Week — Rachel Foucard pulled the sharpest lines from a New York panel on digital sovereignty, touching collaboration, security, sustainability, and public investment.

• 4–5 August 2026 — CMS Connect, Montréal, Canada
• 6–8 August 2026 — TYPO3 Developer Days, Karlsruhe, Germany
• 11–13 September 2026 — TYPO3 Camp München, Munich, Germany
• 15–16 September 2026 — TYPO3 University Days 2026, Erfurt, Germany
• 23–24 September 2026 — DMEXCO, Cologne, Germany
• 15–17 October 2026 — TYPO3 Camp Berlin, Berlin, Germany
• 19–22 October 2026 — TYPO3 Community Sprint October 2026, Düsseldorf, Germany
• 20–21 October 2026 — Open Source CMS 26 Conference, Utrecht, Netherlands
• 3–6 November 2026 — Boye Aarhus, Aarhus C, Denmark
• 6–8 November 2026 — TYPO3 Camp RheinRuhr, Kamp-Lintfort, Germany
• 15–17 April 2027 — TYPO3camp Schweiz, Zürich, Switzerland

Almost everything in this issue came out of a team, and contributing to one does not have to mean patching the core. Sixteen teams and committees need writers, coders, translators, testers, designers and organisers, and most keep an open Slack channel. Find the one that matches what you already do.

• The Best Practices Team sprinted on location in Bonn — Anna Reiter's first-hand account of three days of focused coding, shared screens, and a memorable hunt for lunch.
• Their Children's Day remote code sprint — Karsten Nowak reports that the team's latest remote sprint turned out to be one of their most productive days yet.
• Beyond burnouts and buyouts — Panagiotis Semitekolos on how the TYPO3 Summit 2026 tackled open-source burnout, and why TYPO3's third-way business model may hold up better for agencies than the alternatives.
• Content is the asset, visual is the skin — Benni Mack's argument, written up by Kendall Litton: choosing an enterprise CMS is not a five-year decision, it is a twenty-year one.
• What's new in DDEV for TYPO3 folks — Randy Fay's July round-up covers smoother project setup, updated tooling, workflow improvements, and the governance work keeping DDEV sustainable long-term.
• T3BOARD27 is heading to the Dolomites — the snow-and-code tradition returns 13–20 March 2027 in a UNESCO World Heritage site. Clemens Riccabona says bring winter gear and tech ideas.
• Fractor reached 1.0.0 — the generic file read-analyze-change tool cut its first stable release on 9 July, adding --rules-summary, --memory-limit and --no-diffs options plus an XLIFF file processor package.
• Live reload for Fluid templates — an extension that reloads only the frontend tabs actually affected by a Fluid source-file or content change, using TYPO3 cache tags and rendered-file tags to work out which tabs those are.
• t3lang, a desktop editor for XLIFF translations — a Tauri app for macOS, Windows and Linux that scans a project folder for .xlf files, groups them into catalogs, and converts between XLIFF 1.2 and 2.0 with TYPO3's naming conventions built in.
• Processed Images Cleaner — Torben Hansen's new extension adds a console command that deletes processed files by storage, folder, file or crop variant instead of wiping _processed_ wholesale. It refuses to run without a filter.
• Wrong sorting of inline records in workspace previews — the database-query data processor always queries live records, so orderBy never sees the workspace change. Torben Hansen's fix is a small data processor that re-sorts the overlaid rows.

Someone reading this just finished a migration nobody outside their team will ever hear about. That is exactly the kind of thing worth writing up — along with the camp you helped organize, the extension you released, or the first patch you got merged. Send us what you have been working on.

Thank you to the people who did July's quieter work: the writers who closed out the Extbase rewrite, the Core Team members who turned a reported upload flaw into same-day releases across the LTS and ELTS branches, the sprint organizers in Bonn and online, and the translators keeping Crowdin moving.