Search for packages
| purl | pkg:composer/typo3/cms-core@14.3.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-hwvq-2w67-rvxp
Aliases: CVE-2026-47346 |
TYPO3 CMS has Broken Access Control in its Form Framework ### Problem Backend users with file write permissions were able … |
Vulnerable |
|
GHSA-pjpj-v387-x4vq
Aliases: CVE-2026-11607 |
TYPO3 CMS has Broken Access Control in its Form Framework ### Problem Backend users with access to the Form Framework … |
Vulnerable |
|
GHSA-cg75-qfg2-w9hj
Aliases: CVE-2026-47348 |
TYPO3 CMS has Cross-Site Scripting in Indexed Search ### Problem Editors with access to create or modify page content were … |
Vulnerable |
|
GHSA-3v8v-4wg6-r7qh
Aliases: CVE-2026-47343 |
TYPO3 CMS: Destructive Actions on File Mount Folders ### Problem Non-privileged backend users with file mount access were able to … |
Vulnerable |
|
GHSA-qcmw-6rm2-5x78
Aliases: CVE-2026-47350 |
TYPO3 CMS has Broken Access Control in its DataHandler ### Problem Backend users were able to move records to a … |
Vulnerable |
|
GHSA-jh32-v29g-68pq
Aliases: CVE-2026-49741 |
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework ### Problem Backend users with write access to … |
Vulnerable |
|
GHSA-chm7-4vch-h8vr
Aliases: CVE-2026-49742 |
TYPO3 CMS has Broken Access Control in its Media Module ### Problem Backend users with file download permissions were able … |
Vulnerable |
|
GHSA-f34x-rx2w-7pm3
Aliases: CVE-2026-47349 |
TYPO3 CMS has Broken Access Control in the Recycler Module ### Problem Backend users with access to the Recycler module … |
Vulnerable |
|
GHSA-3p42-w5ch-gg42
Aliases: CVE-2026-47347 |
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities ### Problem Applications that use `GeneralUtility::sanitizeLocalUrl` to allow only local … |
Vulnerable |
|
GHSA-2j54-93q2-3hjq
Aliases: CVE-2026-47352 |
TYPO3 CMS has Broken Access Control in Backend API ### Problem Authenticated backend users were able to retrieve file metadata … |
Vulnerable |
|
GHSA-c78m-c52x-jgwp
Aliases: CVE-2026-49740 |
TYPO3 CMS has Insecure Deserialization via Core API ### Problem TYPO3's cache frontend (`VariableFrontend`) and persistent key-value store (`Registry`) deserialized … |
Vulnerable |
|
GHSA-q93m-25xv-94hh
Aliases: CVE-2026-47351 |
TYPO3 CMS: Broken Access Control in Media Module ### Problem Backend users were able to insert arbitrary records and files … |
Vulnerable |
|
GHSA-jf56-v8jc-jcc5
Aliases: CVE-2026-49738 |
TYPO3 CMS has Broken Access Control in its File Abstraction Layer ### Problem The path allowance check in `GeneralUtility::isAllowedAbsPath()` performed … |
Vulnerable |
|
GHSA-4f2f-jr2m-j7p4
|
Duplicate Advisory: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool ## Duplicate Advisory This advisory has been withdrawn because … |
Not vulnerable |
|
GHSA-68jx-f42c-7599
Aliases: CVE-2026-19418 |
TYPO3 CMS - Broken Access Control in Backend and Install Tool ### Problem The referrer enforcement introduced with [TYPO3-CORE-SA-2020-006](https://news.typo3.com/security/advisory/typo3-core-sa-2020-006) ([CVE-2020-11069](https://www.cve.org/CVERecord?id=CVE-2020-11069)) … |
Not vulnerable |