Sign in
Deutsch English Español Polski
Critical

TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution

  • Disclosed: 30.05.2024
  • Updated: 11.10.2026 10:22

Phar files (formerly known as "PHP archives") can act als self extracting archives which leads to the fact that source code is executed when Phar files are invoked. The Phar file format is not limited to be stored with a dedicated file extension - "bundle.phar" would be valid as well as "bundle.txt" would be. This way, Phar files can be obfuscated as image or text file which would not be denied from being uploaded and persisted to a TYPO3 installation. Due to a missing sanitization of user input, those Phar files can be invoked by manipulated URLs in TYPO3 backend forms. A valid backend user account is needed to exploit this vulnerability. In theory the attack vector would be possible in the TYPO3 frontend as well, however no functional exploit has been identified so far.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package typo3/cms-core >= 8.0.0, < 8.7.17, >= 9.0.0, < 9.3.2, >= 7.0.0, < 7.6.30 8.7.17, 9.3.2, 7.6.30

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-74
Platform
Composer
Package
typo3/cms-core
Disclosed
30.05.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-cc97-g92w-jm65 - CC BY 4.0

Vulnerability history: typo3/cms-core

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (128) in the archive
Total entries
128
First → latest
09.2018 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 35
  • Medium 84
  • Low 8

Disclosures per year

Severity:
  1. TYPO3 CMS - Broken Access Control in Backend and Install Tool
    High CVE-2026-19418 >= 14.0.0, < 14.3.6 14.3.6
  2. TYPO3 CMS has Broken Access Control in its Form Framework
    High CVE-2026-11607 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  3. TYPO3 CMS: Destructive Actions on File Mount Folders
    High CVE-2026-47343 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  4. TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
    High CVE-2026-49741 >= 14.0.0, < 14.3.3 14.3.3
  5. TYPO3 CMS has Broken Access Control in its Form Framework
    High CVE-2026-47346 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  6. TYPO3 CMS has Broken Access Control in its Media Module
    High CVE-2026-49742 >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 11.5.51, 12.4.46, 13.4.31, 14.3.3
  7. TYPO3 Allows Privilege Escalation to System Maintainer
    High · 7.2 CVE-2025-47940 >= 10.4.0, < 10.4.50, >= 11.0.0, < 11.5.44, >= 12.0.0, < 12.4.31, >= 13.0.0, < 13.4.12 10.4.50, 11.5.44, 12.4.31, 13.4.12
  8. TYPO3 Possible Insecure Deserialization in Extbase Request Handling
    High · 8.1 ghsa-5h5v-m596-r6rf >= 8.0.0, < 8.7.30, >= 9.0.0, < 9.5.12 8.7.30, 9.5.12
  9. TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API
    High · 8.8 ghsa-x428-565f-8xj2 >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8
  10. TYPO3 Security Misconfiguration in Frontend Session Handling
    High · 8.2 ghsa-82vp-jr39-4j2j >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8
  11. TYPO3 Arbitrary Code Execution via File List Module
    High · 8.8 ghsa-f9hr-7cfq-mjg2 >= 8.0.0, < 8.7.23, >= 9.0.0, < 9.5.4 8.7.23, 9.5.4
  12. TYPO3 Security Misconfiguration for Backend User Accounts
    High · 7.5 ghsa-rxc9-f2x6-qh4w >= 8.0.0, < 8.7.23, >= 9.0.0, < 9.5.4 8.7.23, 9.5.4
  13. TYPO3 Denial of Service in Frontend Record Registration
    High · 7.5 ghsa-hjx5-v9xg-7h25 >= 8.0.0, < 8.7.21, >= 7.0.0, < 7.6.32 8.7.21, 7.6.32
  14. TYPO3 Security Misconfiguration in Install Tool Cookie
    High · 7.5 ghsa-ppvg-hw62-6ph9 >= 8.0.0, < 8.7.21, >= 9.0.0, < 9.5.2, >= 7.0.0, < 7.6.32 8.7.21, 9.5.2, 7.6.32
  15. TYPO3 CMS Insecure Deserialization
    High · 7.5 ghsa-96jg-pmc4-cx39 >= 8.5.0, < 8.7.17, >= 9.0.0, < 9.3.1 8.7.17, 9.3.1
  16. TYPO3 CMS Privilege Escalation and SQL Injection
    High · 7.5 ghsa-45wj-jv2h-jwrf >= 8.5.0, < 8.7.17, >= 9.0.0, < 9.3.2 8.7.17, 9.3.2
  17. TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution this entry
    Critical · 9.8 ghsa-cc97-g92w-jm65 >= 8.0.0, < 8.7.17, >= 9.0.0, < 9.3.2, >= 7.0.0, < 7.6.30 8.7.17, 9.3.2, 7.6.30
  18. TYPO3 CMS Authentication Bypass vulnerability
    High · 7.5 ghsa-x4rj-f7m6-42c3 >= 8.0.0, < 8.7.17, >= 9.0.0, < 9.3.2, >= 7.0.0, < 7.6.30 8.7.17, 9.3.2, 7.6.30
  19. TYPO3 Install Tool vulnerable to Code Execution
    High · 7.2 CVE-2024-22188 >= 8.0.0, < 8.7.57, >= 9.0.0, < 9.5.46, >= 10.0.0, < 10.4.43, >= 11.0.0, < 11.5.35, >= 12.0.0, < 12.4.11, >= 13.0.0, < 13.0.1 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  20. TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
    High · 7.1 CVE-2024-25121 >= 8.0.0, < 8.7.57, >= 9.0.0, < 9.5.46, >= 10.0.0, < 10.4.43, >= 11.0.0, < 11.5.35, >= 12.0.0, < 12.4.11, >= 13.0.0, < 13.0.1 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
Show more (16) Showing 20 of 36

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.