--- title: "TYPO3-SA-2010-022: Multiple vulnerabilities in TYPO3 Core" url: "https://news.typo3.com/security/advisory/typo3-sa-2010-022" description: It has been discovered that TYPO3 Core is vulnerable to Arbitrary Code Execution, Path Traversal, Cross-Site Scripting (XSS), SQL injection and Information Disclosure. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Product Updates & Roadmap" - TYPO3 CMS --- # TYPO3-SA-2010-022: Multiple vulnerabilities in TYPO3 Core - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-SA-2010-022: Multiple vulnerabilities in TYPO3 Core ========================================================= 16 December 2010 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 Core is vulnerable to Arbitrary Code Execution, Path Traversal, Cross-Site Scripting (XSS), SQL injection and Information Disclosure. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7569d41262328e5ed8d27b53e03970ec.png)[Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) **Component Type:** TYPO3 Core **Affected Versions:** 4.2.15 and below, 4.3.8 and below, 4.4.4 and below **Vulnerability Types:** Arbitrary Code Execution, Path Traversal, Cross-Site Scripting (XSS), SQL injection, Information Disclosure **Overall Severity:** High **Release Date:** December 16, 2010 Vulnerable subcomponent #1: Frontend ------------------------------------ **Vulnerability Type:** Cross-Site Scripting **Severity:** High **Suggested CVSS v2.0:** [AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:L/Au:N/C:P/I:P/A:N/E:F/RL:OF/RC:C%29&g=2&lang=en) ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/)) **CVE:** CVE-2010-5097 ([What's that?](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) **Problem Description:** Failing to properly sanitize user input the click enlarge functionality is susceptible to Cross-Site Scripting. The problem only exists if the TYPO3 caching framework is turned on by configuration. **Solution:** Update to the TYPO3 versions 4.3.9 or 4.4.5 that fix the problem described. TYPO3 versions 4.2.x are not affected. **Credits:** Credits go to Andreas Weber who discovered and reported the issue. **Vulnerability Type:** Cross-Site Scripting **Severity:** Low **Suggested CVSS v2.0:** [AV:N/AC:M/Au:S/C:P/I:N/A:N/E:F/RL:OF/RC:C)](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:S/C:P/I:N/A:N/E:F/RL:OF/RC:C%29&g=2&lang=en) ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/)) **CVE:** CVE-2010-5098 ([What's that?](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) **Problem Description:** For a regular editor it is possible to inject arbitrary HTML or JavaScript into the FORM content object. A valid backend login is required to exploit this vulnerability. **Solution:** Update to the TYPO3 versions 4.2.16, 4.3.9 or 4.4.5 that fix the problem described. **Credits:** Credits go to Security Team Member Helmut Hummel who discovered and reported the issue. Vulnerable subcomponent #2: PHP file inclusion protection API ------------------------------------------------------------- **Vulnerability Type:** Arbitrary Code Execution **Severity:** High **Suggested CVSS v2.0:** [AV:N/AC:M/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:N/C:P/I:P/A:P/E:F/RL:OF/RC:C%29&g=2&lang=en) ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/)) **CVE:** CVE-2010-5099 ([What's that?](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) **Problem Description:** Because of insufficient validation of user input it is possible to circumvent the check for executable php files in some cases. **Solution:** Update to the TYPO3 versions 4.2.16, 4.3.9 or 4.4.5 that fix the problem described. **Credits:** Credits go to Gregor Kopf and Luca Carettoni who discovered and reported the issues. Vulnerable subcomponent #3: Install Tool ---------------------------------------- **Vulnerability Type:** Cross-Site Scripting **Severity:** Medium **TODO: Suggested CVSS v2.0:** [AV:L/AC:M/Au:S/C:P/I:P/A:N/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:L/AC:M/Au:S/C:P/I:P/A:N/E:F/RL:OF/RC:C%29&g=2&lang=en) ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/)) **CVE:** CVE-2010-5100 ([What's that?](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) **Problem Description:** Failing to sanitize user input, the TYPO3 Install Toolis susceptible to XSS attacks in several places. A valid Install Tool login is required to exploit these vulnerabilities. **Solution:** Update to the TYPO3 versions 4.2.16, 4.3.9 or 4.4.5 that fix the problem described. **Credits:** Credits go to Cedric Tissieres who discovered and reported the issues. Vulnerable subcomponent #4: Backend ----------------------------------- **Vulnerability Type:** Remote File Disclosure **Severity:** Low **Suggested CVSS v2.0:** [AV:N/AC:H/Au:S/C:P/I:N/A:N/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:S/C:P/I:N/A:N/E:F/RL:OF/RC:C%29&g=2&lang=en) ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/)) **CVE:** CVE-2010-5101 ([What's that?](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) **Problem Description:** Failing to properly validate user input, the TypoScript file inclusion functionality makes it possible to also include arbitrary php files into the TypoScript setup. A valid admin user login is required to exploit this vulnerability. **Solution:** Update to the TYPO3 versions 4.2.16, 4.3.9 or 4.4.5 that fix the problem described. **Credits:** Credits go to Fabrizio Branca who discovered and reported the issue and also created patches. **Vulnerability Type:** Path Traversal **Severity:** Medium **Suggested CVSS v2.0:** [AV:N/AC:H/Au:S/C:P/I:P/A:P/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:S/C:P/I:P/A:P/E:F/RL:OF/RC:C%29&g=2&lang=en) ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/)) **CVE:** CVE-2010-5102 ([What's that?](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) **Problem Description:** Failing to sanitize user input, the unzip library is susceptible to Path Traversal. **Solution:** Update to the TYPO3 versions 4.2.16, 4.3.9 or 4.4.5 that fix the problem described. **Credits:** Credits go to Anthon Pang who discovered and reported the issue. **Vulnerability Type:** SQL Injection **Severity:** Medium **Suggested CVSS v2.0:** [AV:N/AC:M/Au:S/C:C/I:N/A:N/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:M/Au:S/C:C/I:N/A:N/E:F/RL:OF/RC:C%29&g=2&lang=en) ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/)) **CVE:** CVE-2010-5103 ([What's that?](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) **Problem Description:** Failing to sanitize user input, the list module fuctionality is susceptible to SQL injection. A valid backend login with the rights to access the list module is required to exploit this vulnerability. **Solution:** Update to the TYPO3 versions 4.2.16, 4.3.9 or 4.4.5 that fix the problem described. **Credits:** Credits go to Core Team Member Jigal van Hemert who discovered and reported the issue. Vulnerable subcomponent #5: Database API ---------------------------------------- **Vulnerability Type:** Information Disclosure **Severity:** Low **Suggested CVSS v2.0:** [AV:N/AC:H/Au:N/C:P/I:N/A:N/E:F/RL:OF/RC:C](http://jvnrss.ise.chuo-u.ac.jp/jtg/cvss/cvss2.cgi?vector=%28AV:N/AC:H/Au:N/C:P/I:N/A:N/E:F/RL:OF/RC:C%29&g=2&lang=en) ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/)) **CVE:** CVE-2010-5104 ([What's that?](http://en.wikipedia.org/wiki/Common_Vulnerabilities_and_Exposures)) **Problem Description:** If the database connection to the MySQL database is set to sql\_mode NO\_BACKSLASH\_ESCAPES the TYPO3 Database API method escapeStrForLike() is failing to properly quote user input, making it is possible to inject wildcards into a LIKE query. This could potentially disclose a set of records that are meant to be kept in secret. **Solution:** Update to the TYPO3 versions 4.2.16, 4.3.9 or 4.4.5 that fix the problem described. **Credits:** Credits go to Security Team Member Marcus Krause who discovered and reported the issue.   -   - **General Advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/SecurityGuide). Please subscribe to the typo3-announce mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bb9efc51bced8582e7b8c235f4b5f2b5.png) About the Author [Helmut Hummel](https://news.typo3.com/article/author/helmut-hummel) [More posts by this author](https://news.typo3.com/article/author/helmut-hummel)