Typo3 vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Typo3 products: 82 record(s), with severity, exploitation and fixes.

TYPO3 CMS 23 Typo3 5 Extension "Apache Solr for TYPO3 - Enterprise Search" 5 Extension "femanager" 4 Extension "Faceted Search" 3 Extension "sgalinski Cookie Consent" 3 Femanager 3 HTML Sanitizer 2 Extension "TYPO3 Fluid-Form by coding.ms" 2 Extension "TYPO3 AI Integration Extension" 2 Extension "TYPO3 Shop by coding.ms" 2 Extension "Analytics" 2 Extension "Events 2" 2 Extension "SYSSY - TYPO3 Monitoring & Security Checks" 2 Extension "Modules" 2 Extension "Mailqueue" 2 Extension "Event management and registration" 2 Extension "Frontend User Registration" 1 Extension "File manager" 1 Extension "Kitodo.Presentation" 1 Extension "Site Crawler" 1 Extension "FAL Protect" 1 Extension "E-Mail MFA Provider" 1 Extension "Accessible Form Captcha" 1 Extension "Content Element Selector" 1 Content Consent 1 Direct Mail 1 Extension "Address List" 1 Extension "Forum" 1 Extension "Industry Directory" 1 Extension "Club Directory" 1 Extension "Telephone Directory" 1 Extension "Mask" 1 Extension "HTML5 Video Player vs. Powermail" 1 Extension "Forms Export" 1 Extension "powermail" 1 Extension "News system" 1 Extension "Redirect Tabs" 1

Exploited only (KEV) →

CVE-2026-1323 High · 8.8 CWE-502 Mar 17, 2026

Insecure Deserialization in extension "Mailqueue" (mailqueue)

The extension fails to properly define allowed classes used when deserializing transport failure metadata. An attacker may exploit this to execute untrusted serialized code. Note that an active exploit requires write access to the directory configured at $GLOBALS['TYPO3_CONF_VARS']['MAIL']['transport_spool_filepath'].

CVE-2026-0895 Medium · 5.2 CWE-502 Jan 20, 2026

Insecure Deserialization in extension "Mailqueue" (mailqueue)

The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the extension with a patched TYPO3 core version still allows for Insecure Deserialization, because the affected vulnerable code was extracted from TYPO3 core to the extension. More information about this vulnerability can be found in the related TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 .

CVE-2026-0859 High · 7.8 CWE-502 Jan 13, 2026

TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVE-2025-59022 High · 8.1 CWE-862 Jan 13, 2026

TYPO3 CMS Allows Broken Access Control in Recycler Module

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVE-2025-59021 Medium · 6.4 CWE-862 Jan 13, 2026

TYPO3 CMS Allows Broken Access Control in Redirects Module

Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVE-2025-59020 Medium · 6.5 CWE-863 Jan 13, 2026

TYPO3 CMS Allows Broken Access Control in Edit Document Controller

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

CVE-2025-12998 High · 8.2 CWE-287 Nov 12, 2025

Broken Authentication in extension “Modules” (modules)

Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.