Sign in
Deutsch English Español Polski
High

TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API

  • Disclosed: 30.05.2024
  • Updated: 11.10.2026 10:22

Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfig_includes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings.

A valid backend user account having access to modify values for fields pages.TSconfig and pages.tsconfig_includes is needed in order to exploit this vulnerability.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package typo3/cms-core >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8

References

CVSS score 8.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-22, CWE-79
Platform
Composer
Package
typo3/cms-core
Disclosed
30.05.2024
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-x428-565f-8xj2 - CC BY 4.0

Vulnerability history: typo3/cms-core

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (128) in the archive
Total entries
128
First → latest
09.2018 09.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 35
  • Medium 84
  • Low 8

Disclosures per year

Severity:
  1. TYPO3 CMS - Broken Access Control in Backend and Install Tool
    High CVE-2026-19418 >= 14.0.0, < 14.3.6 14.3.6
  2. TYPO3 CMS has Broken Access Control in its Form Framework
    High CVE-2026-11607 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  3. TYPO3 CMS: Destructive Actions on File Mount Folders
    High CVE-2026-47343 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  4. TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
    High CVE-2026-49741 >= 14.0.0, < 14.3.3 14.3.3
  5. TYPO3 CMS has Broken Access Control in its Form Framework
    High CVE-2026-47346 < 10.4.57, >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
  6. TYPO3 CMS has Broken Access Control in its Media Module
    High CVE-2026-49742 >= 11.0.0, < 11.5.51, >= 12.0.0, < 12.4.46, >= 13.0.0, < 13.4.31, >= 14.0.0, < 14.3.3 11.5.51, 12.4.46, 13.4.31, 14.3.3
  7. TYPO3 Allows Privilege Escalation to System Maintainer
    High · 7.2 CVE-2025-47940 >= 10.4.0, < 10.4.50, >= 11.0.0, < 11.5.44, >= 12.0.0, < 12.4.31, >= 13.0.0, < 13.4.12 10.4.50, 11.5.44, 12.4.31, 13.4.12
  8. TYPO3 Possible Insecure Deserialization in Extbase Request Handling
    High · 8.1 ghsa-5h5v-m596-r6rf >= 8.0.0, < 8.7.30, >= 9.0.0, < 9.5.12 8.7.30, 9.5.12
  9. TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API this entry
    High · 8.8 ghsa-x428-565f-8xj2 >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8
  10. TYPO3 Security Misconfiguration in Frontend Session Handling
    High · 8.2 ghsa-82vp-jr39-4j2j >= 8.0.0, < 8.7.27, >= 9.0.0, < 9.5.8 8.7.27, 9.5.8
  11. TYPO3 Arbitrary Code Execution via File List Module
    High · 8.8 ghsa-f9hr-7cfq-mjg2 >= 8.0.0, < 8.7.23, >= 9.0.0, < 9.5.4 8.7.23, 9.5.4
  12. TYPO3 Security Misconfiguration for Backend User Accounts
    High · 7.5 ghsa-rxc9-f2x6-qh4w >= 8.0.0, < 8.7.23, >= 9.0.0, < 9.5.4 8.7.23, 9.5.4
  13. TYPO3 Denial of Service in Frontend Record Registration
    High · 7.5 ghsa-hjx5-v9xg-7h25 >= 8.0.0, < 8.7.21, >= 7.0.0, < 7.6.32 8.7.21, 7.6.32
  14. TYPO3 Security Misconfiguration in Install Tool Cookie
    High · 7.5 ghsa-ppvg-hw62-6ph9 >= 8.0.0, < 8.7.21, >= 9.0.0, < 9.5.2, >= 7.0.0, < 7.6.32 8.7.21, 9.5.2, 7.6.32
  15. TYPO3 CMS Insecure Deserialization
    High · 7.5 ghsa-96jg-pmc4-cx39 >= 8.5.0, < 8.7.17, >= 9.0.0, < 9.3.1 8.7.17, 9.3.1
  16. TYPO3 CMS Privilege Escalation and SQL Injection
    High · 7.5 ghsa-45wj-jv2h-jwrf >= 8.5.0, < 8.7.17, >= 9.0.0, < 9.3.2 8.7.17, 9.3.2
  17. TYPO3 CMS Insecure Deserialization & Arbitrary Code Execution
    Critical · 9.8 ghsa-cc97-g92w-jm65 >= 8.0.0, < 8.7.17, >= 9.0.0, < 9.3.2, >= 7.0.0, < 7.6.30 8.7.17, 9.3.2, 7.6.30
  18. TYPO3 CMS Authentication Bypass vulnerability
    High · 7.5 ghsa-x4rj-f7m6-42c3 >= 8.0.0, < 8.7.17, >= 9.0.0, < 9.3.2, >= 7.0.0, < 7.6.30 8.7.17, 9.3.2, 7.6.30
  19. TYPO3 Install Tool vulnerable to Code Execution
    High · 7.2 CVE-2024-22188 >= 8.0.0, < 8.7.57, >= 9.0.0, < 9.5.46, >= 10.0.0, < 10.4.43, >= 11.0.0, < 11.5.35, >= 12.0.0, < 12.4.11, >= 13.0.0, < 13.0.1 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
  20. TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
    High · 7.1 CVE-2024-25121 >= 8.0.0, < 8.7.57, >= 9.0.0, < 9.5.46, >= 10.0.0, < 10.4.43, >= 11.0.0, < 11.5.35, >= 12.0.0, < 12.4.11, >= 13.0.0, < 13.0.1 8.7.57, 9.5.46, 10.4.43, 11.5.35, 12.4.11, 13.0.1
Show more (16) Showing 20 of 36

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.