Security Advisories
All Advisories
Follow TYPO3 security advisories as soon as they are published by subscribing to the dedicated security RSS feed.
TYPO3-PSA-2026-001: Critical PHP security release: PHP update required for all TYPO3 installations
Two critical security vulnerabilities in PHP require prompt action: all TYPO3 users should update PHP on their installations right away. TYPO3 itself is not affected and does not need to be updated.
TYPO3-EXT-SA-2026-036: Broken Access Control in extension "shop" (shop)
It has been discovered that the extension "TYPO3 Shop by coding.ms" (shop) is vulnerable to Broken Access Control.
TYPO3-EXT-SA-2026-035: Multiple vulnerabilities in extension "TYPO3 AI Integration Extension" (ns_t3ai)
It has been discovered that the extension “TYPO3 AI Integration Extension” (ns_t3ai) is vulnerable to SQL Injection and Sensitive Data Exposure.
TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager)
It has been discovered that the extension "File manager" (ameos_filemanager) is vulnerable to SQL Injection.
TYPO3-EXT-SA-2026-033: Multiple vulnerabilities in extension "TYPO3 Fluid-Form" (fluid_form)
It has been discovered that the extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) is vulnerable to Cross-Site Scripting and Broken Access Control.
TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
It has been discovered that the extension "Kitodo.Presentation" (dlf) is vulnerable to Server-Side Request Forgery.
TYPO3-EXT-SA-2026-031: Multiple vulnerabilities in extension "Analytics" (analytics)
It has been discovered that the extension "Analytics" (analytics) is vulnerable to Insecure Direct Object Reference (IDOR) and Broken Access Control.
TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
It has been discovered that the extension "Accessible Form Captcha" (bw_captcha) is vulnerable to Captcha Bypass.
TYPO3-EXT-SA-2026-029: Multiple vulnerabilities in extension "sgalinski Cookie Consent" (sg_cookie_optin)
It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.
TYPO3-EXT-SA-2026-028: Broken Access Control in extension "FAL Protect" (fal_protect)
It has been discovered that the extension "FAL Protect" (fal_protect) is vulnerable to Broken Access Control.