--- title: "TYPO3-PSA-2017-001: Privilege Escalation in Extension Repository (TER)" url: "https://news.typo3.com/security/advisory/typo3-psa-2017-001" description: It has been discovered that the TYPO3 Extension Repository (TER) is vulnerable to privilege escalation. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - Public Service Announcement --- # TYPO3-PSA-2017-001: Privilege Escalation in Extension Repository (TER) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2017-001: Privilege Escalation in Extension Repository (TER) ====================================================================== 06 September 2017 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that the TYPO3 Extension Repository (TER) is vulnerable to privilege escalation. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/03e53514e3ec47ddd883bc8acf7e7914.png)[Thomas Löffler](https://news.typo3.com/article/author/thomas-l%C3%B6ffler) **Component Type:** TYPO3 Extension Repository (TER) at extensions.typo3.org **Release Date:** September 6, 2017 **Vulnerability Type:** Privilege Escalation **Vulnerable subcomponent:** SOAP web service **Severity:** Critical **Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:U/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=%28AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:U/RC:C%29) **CVE:** not assigned yet **Problem Description:** Due to incomplete user authentication it has been possible to gain privileged access to manage any extension on extensions.typo3.org without being properly authenticated using the SOAP web service since the launch of extensions.typo3.org on August 23rd. In theory this would have allowed in the mentioned timeframe to remove extension keys, to remove existing extension versions as well as to (re-)upload new extension versions. This vulnerability could be exploited having knowledge of a valid extension key and a valid typo3.org user account name - an arbitrary password could be used to bypass the authentication process. Concerning existing extension releases before August 22nd, 2017 no compromised code could be found by comparing SHA-256 checksums from previous typo3.org storage with current extensions.typo3.org storage. However, for 56 newly uploaded extension versions that were only available on extensions.typo3.org there is NO guarantee that these packages do not contain malware or have not been compromised in any way. Check the list of possible compromised extension releases: - advancedtitle (0.0.4, 0.0.5) - aimeos (17.7.1) - aimeos\_pay (17.8.0, 17.8.1) - aip\_vimeo (8.7.3) - aws\_sdk\_php (3.33.4, 3.34.0, 3.34.1, 3.34.2, 3.35.0, 3.35.1, 3.35.2) - cart\_pdf (1.3.0, 2.0.0, 2.0.1) - cl\_metatags (2.0.4) - cookie\_hint (1.0.0, 1.0.1, 1.0.2) - cookie\_question (0.1.0) - datamints\_feuser - (0.11.7, 0.11.8) - div2007 (1.7.10) - femanager (3.1.1) - feusersmap (0.8.2) - frp\_form\_answers (1.0.0, 1.0.1) - go\_maps\_ext (2.3.0) - hh\_ckeditor\_custom (0.1.1) - ipm\_cline (1.2.0) - includekrexx (2.3.0) - maps2 (2.9.0) - my\_user\_management (3.3.0, 3.3.1, 3.3.2, 3.3.3) - news (6.1.0) - patchem (0.1.0) - powermail (3.22.0) - px\_hybrid\_auth (3.1.1) - px\_semantic (2.5.0) - realurl\_clearcache2 (1.0.0, 1.0.1, 2.0.0) - recordsmanager (1.4.0) - skfbalbums (0.0.1, 0.0.2) - static\_info\_tables\_pt (6.3.2) - test\_foo (0.1.0, 0.1.1) - turn (0.1.1) - url\_redirect (1.1.0, 1.1.1) - vhs (4.3.0) - wfqbe (7.6.2) **Solution:** All extensions that have been uploaded to extensions.typo3.org since August 23rd, 2017 have been marked as insecure. Extension owners have been informed to provide new releases of their according extensions. Extensions that are listed as possibly compromised above have to be deleted from TYPO3 installations or replaced by newer extension releases. Users of these extensions are advised to update as soon as possible. **Credits:** Credits go to Benjamin Serfhos who discovered and reported the vulnerability and to TYPO3 security team leader Helmut Hummel who analyzed and fixed the issue. **General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Opens external link in new window"). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. **General Note:** All security related code changes are tagged so that you can easily look them up on our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/6ec9ecb042183e3c26d9be5e0b8565ad.png) About the Author [Thomas Löffler](https://news.typo3.com/article/author/thomas-l%C3%B6ffler) Thomas Löffler is a seasoned TYPO3 developer, former freelancer, and open-source contributor with over 15 years of experience in web development. As the owner of Spooner Web, he specializes in TYPO3, PHP, and GitLab solutions. Since 2005, Thomas has been an active member of the TYPO3 community, currently serving as the team lead and technical lead of the typo3.org website team. He is a Certified TYPO3 Developer and Integrator, dedicated to advancing TYPO3's ecosystem through development, consulting, and mentorship. Since 2026 he is employee of KM2 >> GmbH. [More posts by this author](https://news.typo3.com/article/author/thomas-l%C3%B6ffler)