Search for packages
| purl | pkg:composer/typo3/cms-core@12.4.25 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-p5jq-5383-qvc7
Aliases: CVE-2025-59015 |
TYPO3 CMS uses insufficient entropy when generating passwords A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS … |
Vulnerable |
|
GHSA-hwvq-2w67-rvxp
Aliases: CVE-2026-47346 |
TYPO3 CMS has Broken Access Control in its Form Framework ### Problem Backend users with file write permissions were able … | There are no reported fixed by versions. |
|
GHSA-pjpj-v387-x4vq
Aliases: CVE-2026-11607 |
TYPO3 CMS has Broken Access Control in its Form Framework ### Problem Backend users with access to the Form Framework … | There are no reported fixed by versions. |
|
GHSA-3v8v-4wg6-r7qh
Aliases: CVE-2026-47343 |
TYPO3 CMS: Destructive Actions on File Mount Folders ### Problem Non-privileged backend users with file mount access were able to … | There are no reported fixed by versions. |
|
GHSA-chm7-4vch-h8vr
Aliases: CVE-2026-49742 |
TYPO3 CMS has Broken Access Control in its Media Module ### Problem Backend users with file download permissions were able … | There are no reported fixed by versions. |
|
GHSA-f34x-rx2w-7pm3
Aliases: CVE-2026-47349 |
TYPO3 CMS has Broken Access Control in the Recycler Module ### Problem Backend users with access to the Recycler module … | There are no reported fixed by versions. |
|
GHSA-3p42-w5ch-gg42
Aliases: CVE-2026-47347 |
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities ### Problem Applications that use `GeneralUtility::sanitizeLocalUrl` to allow only local … | There are no reported fixed by versions. |
|
GHSA-2j54-93q2-3hjq
Aliases: CVE-2026-47352 |
TYPO3 CMS has Broken Access Control in Backend API ### Problem Authenticated backend users were able to retrieve file metadata … | There are no reported fixed by versions. |
|
GHSA-c78m-c52x-jgwp
Aliases: CVE-2026-49740 |
TYPO3 CMS has Insecure Deserialization via Core API ### Problem TYPO3's cache frontend (`VariableFrontend`) and persistent key-value store (`Registry`) deserialized … | There are no reported fixed by versions. |
|
GHSA-q93m-25xv-94hh
Aliases: CVE-2026-47351 |
TYPO3 CMS: Broken Access Control in Media Module ### Problem Backend users were able to insert arbitrary records and files … | There are no reported fixed by versions. |
|
GHSA-jf56-v8jc-jcc5
Aliases: CVE-2026-49738 |
TYPO3 CMS has Broken Access Control in its File Abstraction Layer ### Problem The path allowance check in `GeneralUtility::isAllowedAbsPath()` performed … | There are no reported fixed by versions. |
|
CVE-2025-47937
Aliases: GHSA-x8pv-fgxp-8v3x |
TYPO3 Allows Information Disclosure via DBAL Restriction Handling ### Problem When performing a database query involving multiple tables through the … |
Vulnerable Vulnerable |
|
CVE-2025-47940
Aliases: GHSA-6frx-j292-c844 |
TYPO3 Allows Privilege Escalation to System Maintainer ### Problem Administrator-level backend users without system maintainer privileges can escalate their privileges … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2025-47939
Aliases: GHSA-9hq9-cr36-4wpj |
TYPO3 Allows Unrestricted File Upload in File Abstraction Layer ### Problem By design, the file management module in TYPO3’s backend … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2026-0859
Aliases: GHSA-7vp9-x248-9vr9 |
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool ### Problem Local platform users who can write to TYPO3’s mail‑file … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2025-47938
Aliases: GHSA-3jrg-97f3-rqh9 |
TYPO3 Unverified Password Change for Backend Users ### Problem The backend user management interface allows password changes without requiring the … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-3jrg-97f3-rqh9
Aliases: CVE-2025-47938 |
TYPO3 Unverified Password Change for Backend Users ### Problem The backend user management interface allows password changes without requiring the … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-6frx-j292-c844
Aliases: CVE-2025-47940 |
TYPO3 Allows Privilege Escalation to System Maintainer ### Problem Administrator-level backend users without system maintainer privileges can escalate their privileges … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-9hq9-cr36-4wpj
Aliases: CVE-2025-47939 |
TYPO3 Allows Unrestricted File Upload in File Abstraction Layer ### Problem By design, the file management module in TYPO3’s backend … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-x8pv-fgxp-8v3x
Aliases: CVE-2025-47937 |
TYPO3 Allows Information Disclosure via DBAL Restriction Handling ### Problem When performing a database query involving multiple tables through the … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-72jf-5fg5-3cw3
Aliases: CVE-2025-59013 |
TYPO3 CMS has an open‑redirect vulnerability An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 … |
Vulnerable Vulnerable |
|
GHSA-cvm2-5f78-g9m8
Aliases: CVE-2025-59016 |
TYPO3 CMS exposes sensitive information in an error message Error messages containing sensitive information in the File Abstraction Layer in … |
Vulnerable Vulnerable |
|
GHSA-7vp9-x248-9vr9
Aliases: CVE-2026-0859 |
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool ### Problem Local platform users who can write to TYPO3’s mail‑file … |
Vulnerable Vulnerable Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2024-55892
|
TYPO3 Potential Open Redirect via Parsing Differences ### Problem Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via … |
GHSA-2fx5-pggv-6jjr
|
|
GHSA-2fx5-pggv-6jjr
|
TYPO3 Potential Open Redirect via Parsing Differences ### Problem Applications that use `TYPO3\CMS\Core\Http\Uri` to parse externally provided URLs (e.g., via … |
CVE-2024-55892
|