--- title: "TYPO3-CORE-SA-2019-012: Possible Arbitrary Code Execution in Image Processing" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2019-012" description: It has been discovered, that TYPO3 CMS is vulnerable to arbitrary code execution. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - TYPO3 CMS --- # TYPO3-CORE-SA-2019-012: Possible Arbitrary Code Execution in Image Processing - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2019-012: Possible Arbitrary Code Execution in Image Processing ============================================================================= 07 May 2019 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered, that TYPO3 CMS is vulnerable to arbitrary code execution. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b8266fdc667b773926c59081862ab148.jpeg)[Oliver Hader](https://news.typo3.com/article/author/oliver-hader) - **Component Type:** TYPO3 CMS - **Vulnerable subcomponent:** Image Processing via ImageMagick (ext:core) - **Release Date:** May 7, 2019 - **Vulnerability Type:** Arbitrary Code Execution - **Affected Versions:** 8.0.0-8.7.24 and 9.0.0-9.5.5 - **Severity:** High - Critical - **Suggested CVSS v3.0:** [AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C) - **CVE:** [CVE-2019-11832](https://nvd.nist.gov/vuln/detail/CVE-2019-11832) ### Problem Description Image processing, e.g. for generating thumbnails, is actually delegated to ImageMagick (or GraphicsMagick) for the low-level processing. Whenever ImageMagick is invoked in order to convert data the mime-type of the source is identified for invoking according coders when reading data. In case an attacker manages to upload an image file containing PostScript code it will be executed on the server system when generating according visual previews or thumbnails. In order to exploit this vulnerability the following aspects must be fulfilled: - GhostScript binary *gs* available on server system - ImageMagick policy.xml settings are not strict (see below in next section) - either having a valid backend user account having access to filelist module - or having some frontend application that allows uploading and previewing files without according file mime-type validation ### Solution Update to TYPO3 versions 8.7.25 or 9.5.6 that fix the problem described. In general it is suggested to make use of according ImageMagick policy.xml settings in order to disable potential insecure file types. ImageMagick suggests to disable PDF which probably still should be allowed for a content management system - the reason is that ImageMagick uses the GhostScript interpreter in order to convert PostScript and PDF contents which has been vulnerable to buffer overflow. Please read those suggestions provided at Image processing in TYPO3 has been changed to explicitly require an according image format even if the file contents are e.g. PostScript code - this mitigates the possibility of arbitrary code execution. The following example shows low-level Image invocation for an arbitrary file that is expected to be PNG. Executing PostScript is disabled using the according *png:* format prefix. ``` convert -geometry 200x100 png:malicious.ps.png thumbnail.png ``` ### Credits Thanks to [Lauritz Holtmann](https://github.com/lauritzh) who reported & analyzed this issue and to TYPO3 security team member Oliver Hader who fixed the issue. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ### General Note All security related code changes are tagged so that you can easily look them up in our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/cc7cba9757f98fbe05023a139119df74.jpeg) About the Author [Oliver Hader](https://news.typo3.com/article/author/oliver-hader) Core Developer at TYPO3 GmbH,Hof, Germany [Website](https://typo3.com)[Twitter](https://twitter.com/ohader)[LinkedIn](https://www.linkedin.com/in/oliverhader/)[Xing](https://www.xing.com/profile/Oliver_Hader) Oliver started to work with TYPO3 in 2005 and was fascinated by the product and its universe. Since 2007 he is member of the TYPO3 Core Team. After going back to university in 2014 for achieving a postgraduate master degree in internet web science, he is now researching on advanced web technology topics in general and for TYPO3 in particular. In his spare time, Oliver loves to go cycling cross-country in the uplands around Hof (Germany) in northern Bavaria - at the region where he's living as well. [More posts by this author](https://news.typo3.com/article/author/oliver-hader)