Security advisories for TYPO3

In focus — Picked as one of the six most noteworthy entries of the week and shown in the slider at the top.SecuritySeverity unknown
TYPO3-EXT-SA-2026-027: SQL Injection in extension "Forms Export" (frp_form_answers)
It has been discovered that the extension "Forms Export" (frp_form_answers) is vulnerable to SQL Injection.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-027
In focus — Picked as one of the six most noteworthy entries of the week and shown in the slider at the top.SecuritySeverity unknown
TYPO3-EXT-SA-2026-026: Broken Access Control in extension "Events 2" (events2)
It has been discovered that the extension "Events 2" (events2) is susceptible to two instances of Broken Access Control.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-026
In focus — Picked as one of the six most noteworthy entries of the week and shown in the slider at the top.SecuritySeverity unknown
TYPO3-EXT-SA-2026-025: Multiple Vulnerabilities in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)
It has been discovered that the extension "Apache Solr for TYPO3 - Enterprise Search" (solr) is vulnerable to Broken Access Control, Insecure Deserialization and Information Disclosure.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-025
In focus — Picked as one of the six most noteworthy entries of the week and shown in the slider at the top.SecuritySeverity unknown
TYPO3-EXT-SA-2026-024: Multiple vulnerabilities in extension "femanager" (femanager)
It has been discovered that the extension "femanager" (femanager) is vulnerable to Broken Access Control and Information Disclosure.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-024
In focus — Picked as one of the six most noteworthy entries of the week and shown in the slider at the top.SecuritySeverity unknown
TYPO3-EXT-SA-2026-023: Multiple vulnerabilities in extension "Event management and registration" (sf_event_mgt)
It has been discovered that the extension "Event management and registration" (sf_event_mgt) is vulnerable to Broken Access Control and Server-Side Template Injection (SSTI).
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-023
SecuritySeverity unknown
TYPO3-EXT-SA-2026-022: Server-Side Template Injection (SSTI) in extension "powermail" (powermail)
It has been discovered that the extension "powermail" (powermail) is vulnerable to Server-Side Template Injection (SSTI).
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-022
SecuritySeverity unknown
TYPO3-EXT-SA-2026-021: Broken Access Control in extension "Forum" (pforum)
It has been discovered that the extension "Forum" (pforum) is susceptible to Broken Access Control.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-021
SecuritySeverity unknown
TYPO3-EXT-SA-2026-020: Broken Access Control in extension "Industry Directory" (yellowpages2)
It has been discovered that the extension "Industry Directory" (yellowpages2) is susceptible to Broken Access Control.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-020
SecuritySeverity unknown
TYPO3-EXT-SA-2026-019: Broken Access Control in extension "Club Directory" (clubdirectory)
It has been discovered that the extension "Club Directory" (clubdirectory) is susceptible to Broken Access Control.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-019
SecuritySeverity unknown
TYPO3-EXT-SA-2026-018: Broken Access Control in extension "Telephone Directory" (telephonedirectory)
It has been discovered that the extension "Telephone Directory" (telephonedirectory) is susceptible to Broken Access Control.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-018
SecuritySeverity unknown
TYPO3-EXT-SA-2026-017: Path Traversal in extension "Mask" (mask)
It has been discovered that the extension "Mask" (mask) is vulnerable to Path Traversal.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-017
SecuritySeverity unknown
TYPO3-EXT-SA-2026-016: Information Disclosure in extension "Modules" (modules)
It has been discovered that the extension "Modules" (modules) is vulnerable to Information Disclosure.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-016
SecuritySeverity unknown
TYPO3-EXT-SA-2026-015: Multiple Vulnerabilities in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)
It has been discovered that the extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) is vulnerable to Insufficient Session Expiration and Cleartext Transmission of Sensitive Information.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-015
SecuritySeverity unknown
TYPO3-EXT-SA-2026-014: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)
It has been discovered that the extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) is vulnerable to Remote Code Execution.
TYPO3 Security Advisories 25.08.2026 TYPO3-EXT-SA-2026-014
SecuritySeverity unknown
TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 11.08.2026 TYPO3-CORE-SA-2026-021
SecuritySeverity unknown
TYPO3-CORE-SA-2026-020: Unrestricted File Upload in Form Framework
It has been discovered that TYPO3 CMS is susceptible to security misconfiguration.
TYPO3 Security Advisories 14.07.2026 TYPO3-CORE-SA-2026-020
SecurityHigh
TYPO3-CORE-SA-2026-019: Broken Access Control in Form Framework
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-019
SecurityMedium
TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-018
SecurityHigh
TYPO3-CORE-SA-2026-017: Privilege Escalation & SQL Injection in Form Framework
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-017
SecurityLow
TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-016
SecurityMedium
TYPO3-CORE-SA-2026-015: Broken Access Control in Backend API
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-015
SecurityMedium
TYPO3-CORE-SA-2026-014: Broken Access Control in Clipboard
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-014
SecurityHigh
TYPO3-CORE-SA-2026-013: Broken Access Control in Media Module
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-013
SecurityMedium
TYPO3-CORE-SA-2026-012: Broken Access Control in DataHandler
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-012
SecurityMedium
TYPO3-CORE-SA-2026-011: Broken Access Control in Recycler
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-011
SecurityMedium
TYPO3-CORE-SA-2026-010: Cross-Site Scripting in Indexed Search
It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-010
SecurityMedium
TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS
It has been discovered that TYPO3 CMS is susceptible to open redirect.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-009
SecurityHigh
TYPO3-CORE-SA-2026-008: Broken Access Control in Form Framework
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-008
SecurityHigh
TYPO3-CORE-SA-2026-007: Broken Access Control in File Abstraction Layer
It has been discovered that TYPO3 CMS is susceptible to broken access control.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-007
SecurityMedium
TYPO3-CORE-SA-2026-006: By-passing Cross-Site Scripting Protection in HTML Sanitizer
It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting.
TYPO3 Security Advisories 09.06.2026 TYPO3-CORE-SA-2026-006

Security advisories, releases and news from the TYPO3 ecosystem