Recent posts en https://news.typo3.com/security/rss-security Sun, 25 Oct 2026 14:37:40 +0100 https://news.typo3.com/article/typo3-psa-2026-001https://news.typo3.com/article/typo3-psa-2026-001#commentsWed, 21 Oct 2026 17:15:29 +0200Luana Valentinihttps://news.typo3.com/article/typo3-psa-2026-001Two critical security vulnerabilities in PHP require prompt action: all TYPO3 users should update PHP on their installations right away. TYPO3 itself is not affected and does not need to be updated. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-036https://news.typo3.com/security/advisory/typo3-ext-sa-2026-036#commentsTue, 20 Oct 2026 11:08:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-036It has been discovered that the extension "TYPO3 Shop by coding.ms" (shop) is vulnerable to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-035https://news.typo3.com/security/advisory/typo3-ext-sa-2026-035#commentsTue, 20 Oct 2026 11:07:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-035It has been discovered that the extension “TYPO3 AI Integration Extension” (ns_t3ai) is vulnerable to SQL Injection and Sensitive Data Exposure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-034https://news.typo3.com/security/advisory/typo3-ext-sa-2026-034#commentsTue, 20 Oct 2026 11:06:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-034It has been discovered that the extension "File manager" (ameos_filemanager) is vulnerable to SQL Injection. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033#commentsTue, 20 Oct 2026 11:05:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-033It has been discovered that the extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) is vulnerable to Cross-Site Scripting and Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032https://news.typo3.com/security/advisory/typo3-ext-sa-2026-032#commentsTue, 20 Oct 2026 11:04:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-032It has been discovered that the extension "Kitodo.Presentation" (dlf) is vulnerable to Server-Side Request Forgery. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031#commentsTue, 20 Oct 2026 11:03:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-031It has been discovered that the extension "Analytics" (analytics) is vulnerable to Insecure Direct Object Reference (IDOR) and Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-030https://news.typo3.com/security/advisory/typo3-ext-sa-2026-030#commentsTue, 20 Oct 2026 11:02:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-030It has been discovered that the extension "Accessible Form Captcha" (bw_captcha) is vulnerable to Captcha Bypass. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029#commentsTue, 20 Oct 2026 11:01:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-029It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-028https://news.typo3.com/security/advisory/typo3-ext-sa-2026-028#commentsTue, 20 Oct 2026 11:00:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-028It has been discovered that the extension "FAL Protect" (fal_protect) is vulnerable to Broken Access Control. https://news.typo3.com/security/advisory/typo3-core-sa-2026-024https://news.typo3.com/security/advisory/typo3-core-sa-2026-024#commentsTue, 13 Oct 2026 11:00:00 +0200Elias Häußlerhttps://news.typo3.com/security/advisory/typo3-core-sa-2026-024It has been discovered that TYPO3 CMS is susceptible to ignored upload storage configuration in the Form Framework. https://news.typo3.com/security/advisory/typo3-core-sa-2026-023https://news.typo3.com/security/advisory/typo3-core-sa-2026-023#commentsTue, 08 Sep 2026 11:01:00 +0200Elias Häußlerhttps://news.typo3.com/security/advisory/typo3-core-sa-2026-023It has been discovered that TYPO3 CMS is susceptible to unauthorized modification of system-wide configuration. https://news.typo3.com/security/advisory/typo3-core-sa-2026-022https://news.typo3.com/security/advisory/typo3-core-sa-2026-022#commentsTue, 08 Sep 2026 11:00:00 +0200Elias Häußlerhttps://news.typo3.com/security/advisory/typo3-core-sa-2026-022It has been discovered that TYPO3 CMS is susceptible to information disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027#commentsTue, 25 Aug 2026 10:14:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-027It has been discovered that the extension "Forms Export" (frp_form_answers) is vulnerable to SQL Injection. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026#commentsTue, 25 Aug 2026 10:13:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-026It has been discovered that the extension "Events 2" (events2) is susceptible to two instances of Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025#commentsTue, 25 Aug 2026 10:12:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-025It has been discovered that the extension "Apache Solr for TYPO3 - Enterprise Search" (solr) is vulnerable to Broken Access Control, Insecure Deserialization and Information Disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024#commentsTue, 25 Aug 2026 10:11:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-024It has been discovered that the extension "femanager" (femanager) is vulnerable to Broken Access Control and Information Disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023#commentsTue, 25 Aug 2026 10:10:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-023It has been discovered that the extension "Event management and registration" (sf_event_mgt) is vulnerable to Broken Access Control and Server-Side Template Injection (SSTI). https://news.typo3.com/security/advisory/typo3-ext-sa-2026-022https://news.typo3.com/security/advisory/typo3-ext-sa-2026-022#commentsTue, 25 Aug 2026 10:09:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-022It has been discovered that the extension "powermail" (powermail) is vulnerable to Server-Side Template Injection (SSTI). https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021#commentsTue, 25 Aug 2026 10:08:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-021It has been discovered that the extension "Forum" (pforum) is susceptible to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-020https://news.typo3.com/security/advisory/typo3-ext-sa-2026-020#commentsTue, 25 Aug 2026 10:07:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-020It has been discovered that the extension "Industry Directory" (yellowpages2) is susceptible to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-019https://news.typo3.com/security/advisory/typo3-ext-sa-2026-019#commentsTue, 25 Aug 2026 10:06:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-019It has been discovered that the extension "Club Directory" (clubdirectory) is susceptible to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-018https://news.typo3.com/security/advisory/typo3-ext-sa-2026-018#commentsTue, 25 Aug 2026 10:05:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-018It has been discovered that the extension "Telephone Directory" (telephonedirectory) is susceptible to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-017https://news.typo3.com/security/advisory/typo3-ext-sa-2026-017#commentsTue, 25 Aug 2026 10:04:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-017It has been discovered that the extension "Mask" (mask) is vulnerable to Path Traversal. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-016https://news.typo3.com/security/advisory/typo3-ext-sa-2026-016#commentsTue, 25 Aug 2026 10:03:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-016It has been discovered that the extension "Modules" (modules) is vulnerable to Information Disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015#commentsTue, 25 Aug 2026 10:02:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-015It has been discovered that the extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) is vulnerable to Insufficient Session Expiration and Cleartext Transmission of Sensitive Information. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-014https://news.typo3.com/security/advisory/typo3-ext-sa-2026-014#commentsTue, 25 Aug 2026 10:01:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-014It has been discovered that the extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) is vulnerable to Remote Code Execution. https://news.typo3.com/security/advisory/typo3-core-sa-2026-021https://news.typo3.com/security/advisory/typo3-core-sa-2026-021#commentsTue, 11 Aug 2026 09:30:00 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-core-sa-2026-021It has been discovered that TYPO3 CMS is susceptible to broken access control. https://news.typo3.com/security/advisory/typo3-core-sa-2026-020https://news.typo3.com/security/advisory/typo3-core-sa-2026-020#commentsTue, 14 Jul 2026 12:00:00 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-core-sa-2026-020It has been discovered that TYPO3 CMS is susceptible to security misconfiguration. https://news.typo3.com/security/advisory/typo3-core-sa-2026-019https://news.typo3.com/security/advisory/typo3-core-sa-2026-019#commentsTue, 09 Jun 2026 12:19:00 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-core-sa-2026-019It has been discovered that TYPO3 CMS is susceptible to broken access control.