--- title: "TYPO3-CORE-SA-2013-002: Cross-Site Scripting and Remote Code Execution Vulnerability in TYPO3 Core" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2013-002" description: It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting and Remote Code Execution image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Product Updates & Roadmap" - TYPO3 CMS --- # TYPO3-CORE-SA-2013-002: Cross-Site Scripting and Remote Code Execution Vulnerability in TYPO3 Core - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2013-002: Cross-Site Scripting and Remote Code Execution Vulnerability in TYPO3 Core ================================================================================================== 30 July 2013 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 Core is vulnerable to Cross-Site Scripting and Remote Code Execution - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/60cadc25d9a14674c5c05025d6f818a4.jpeg)[Georg Ringer](https://news.typo3.com/article/author/georg-ringer) **Component Type:** TYPO3 Core **Vulnerability Types:** Cross-Site Scripting, Remote Code Execution **Overall Severity:** Critical **Release Date:** July 30, 2013   - Vulnerable subcomponent: Third Party Libraries used for audio and video playback -------------------------------------------------------------------------------- **Vulnerability Type:** Cross-Site Scripting **Affected Versions:** All versions from 4.5.0 up to the development branch of 6.2 **Severity:** Medium **Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:O/RC:C%29&g=3&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **Related CVEs:** [CVE-2011-3642](https://security-tracker.debian.org/tracker/CVE-2011-3642), [CVE-2013-1464](http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1464) **Problem Description:** TYPO3 bundles flash files for video and audio playback. Old versions of FlowPlayer and flashmedia are susceptible to Cross-Site Scripting. No authentication is required to exploit this vulnerability. **Solution:** Update to the TYPO3 version 4.5.29, 4.7.14, 6.0.8 or 6.1.3 that fix the problem described! **Credits:** Credits go to Markus Pieton and Vytautas Paulikas who discovered and reported the issues.   - Vulnerable subcomponent: Backend File Upload / File Abstraction Layer --------------------------------------------------------------------- **Vulnerability Type:** Remote Code Execution by arbitrary file creation **Affected Versions:** All versions from 6.0.0 up to the development branch of 6.2 **Severity:** Critical **Suggested CVSS v2.0:** [AV:N/AC:L/Au:S/C:C/I:C/A:C/E:F/RL:O/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:S/C:C/I:C/A:C/E:F/RL:O/RC:C%29&g=3&lang=en "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **CVE:** CVE-2013-4250 **Problem Description:** The file upload component and the File Abstraction Layer are failing to check for denied file extensions, which allows authenticated editors (even with limited permissions) to upload php files with arbitrary code, which can then be executed in web server's context. **Solution:** Update to the TYPO3 version 6.0.8 or 6.1.3 that fix the problem described! **Credits:** Credits go to Sebastian Nerz who discovered and reported the issue. **General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://typo3.org/documentation/document-library/extension-manuals/doc_guide_security/current/ "Opens external link in new window"). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/99db18b2c6e92024e8936def3dc244e7.jpeg) About the Author [Georg Ringer](https://news.typo3.com/article/author/georg-ringer) TYPO3 developer,Linz, Austria [Website](http://montagmorgen.at/)[Twitter](https://twitter.com/georg_ringer)[LinkedIn](https://www.linkedin.com/in/georgringer/)[Xing](https://www.xing.com/profile/Georg_Ringer/cv) Georg Ringer has been part of the TYPO3 community more than 10 years and is known for the large number of extensions he has published. He is part of the TYPO3 Core and Security Teams and is also the GDPR Initiative Lead. [More posts by this author](https://news.typo3.com/article/author/georg-ringer)