Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/typo3/flow@3.0.1
purl pkg:composer/typo3/flow@3.0.1
Next non-vulnerable version 3.0.10
Latest non-vulnerable version 4.0.6
Risk
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-hy8r-du1x-93cf
Aliases:
Flow-SA-2016-001
Time-Based Information Disclosure Vulnerability The `PersistedUsernamePasswordProvider` is prone to a information disclosure of account existence based on timing attacks as the hashing of passwords is only done in case an account is found.
3.0.10
Affected by 0 other vulnerabilities.
3.1.7
Affected by 0 other vulnerabilities.
3.2.7
Affected by 0 other vulnerabilities.
3.3.5
Affected by 0 other vulnerabilities.
VCID-xc43-9az2-bbd2
Aliases:
GMS-2016-159
Information Exposure Through Timing Discrepancy Time-Based Information Disclosure Vulnerability in Flow.
3.0.10
Affected by 0 other vulnerabilities.
3.1.7
Affected by 0 other vulnerabilities.
3.2.7
Affected by 0 other vulnerabilities.
3.3.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (4)
Vulnerability Summary Aliases
VCID-1ang-rha7-7faa XXE vulnerability A potential XML External Entity processing vulnerability has been discovered in the MediaTypeConverter. GMS-2015-45
VCID-hy4y-a1fn-6fdn Typo3 Arbitrary file upload and XML External Entity processing GHSA-2p4f-vc9q-r5vp
VCID-shuq-gfkg-duan Improper Restriction of XML External Entity Reference Arbitrary file upload and XML External Entity processing. GMS-2015-92
VCID-xa2m-k18s-x7hv Arbitrary File Upload There's a flaw that allows arbitrary file uploads, including server-side scripts, posing the risk of attacks. GMS-2015-44

Date Actor Action Vulnerability Source VulnerableCode Version
2026-05-31T10:49:56.412843+00:00 GithubOSV Importer Fixing VCID-hy4y-a1fn-6fdn https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-2p4f-vc9q-r5vp/GHSA-2p4f-vc9q-r5vp.json 38.6.0
2026-05-31T09:36:22.525005+00:00 GitLab Importer Affected by VCID-xc43-9az2-bbd2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/flow/GMS-2016-159.yml 38.6.0
2026-05-31T09:36:22.273232+00:00 GitLab Importer Affected by VCID-hy8r-du1x-93cf https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/flow/Flow-SA-2016-001.yml 38.6.0
2026-05-31T01:03:46.743623+00:00 GHSA Importer Fixing VCID-hy4y-a1fn-6fdn https://github.com/advisories/GHSA-2p4f-vc9q-r5vp 38.6.0
2026-05-30T20:52:18.946061+00:00 GitLab Importer Fixing VCID-1ang-rha7-7faa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/flow/GMS-2015-45.yml 38.6.0
2026-05-30T20:52:18.905678+00:00 GitLab Importer Fixing VCID-xa2m-k18s-x7hv https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/flow/GMS-2015-44.yml 38.6.0
2026-05-30T20:52:18.857985+00:00 GitLab Importer Fixing VCID-shuq-gfkg-duan https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/flow/GMS-2015-92.yml 38.6.0