typo3 has 30 CVEs on record. Cadence is steady at roughly 15 per quarter. The busiest recent month was June 2026 with 15. The median CVSS is 6.3 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (11) and CWE-863 (5). Most affected products: typo3/cms-core (13), apache-solr-for-typo3/solr (5), femanager (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 15 prev 15
Weakness classes
Products
- typo3/cms-core 13
- apache-solr-for-typo3/solr 5
- femanager 3
- typo3/cms-backend 2
- typo3/html-sanitizer 2
- codingms/modules 1
Worst active — by depth score
CVE-2023-50461High· 8.8An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO348CVE-2026-56096Medium· 6.3The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries47CVE-2026-56095High· 7.7The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object t…42CVE-2026-56092High· 7.6The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass exten…42CVE-2026-85400High· 7.5Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands41
typo3 vulnerabilities
CVEs affecting typo3, newest first. Open any entry for full detail, references, and exploit status.
30 CVEsRSS
CVE-2023-50461High· 8.8An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3
An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured …
CVE-2023-50460Medium· 5.4An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3
An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions (userLogout, confirmUser, refuseUser, and resendUserConfirmation) for any f…
CVE-2023-45023Medium· 4.2The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.
The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component.
CVE-2023-50462Medium· 5.3An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3
An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to…
CVE-2023-50459Medium· 5.4An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3
An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend user…
CVE-2026-85400High· 7.5Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands
Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is nor…
CVE-2026-77132Medium· 5.3It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks
It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content ele…
CVE-2026-19418HighTYPO3 CMS - Broken Access Control in Backend and Install Tool
TYPO3 CMS - Broken Access Control in Backend and Install Tool
CVE-2026-15305MediumTYPO3 CMS - Unrestricted File Upload in Form Framework
TYPO3 CMS - Unrestricted File Upload in Form Framework
CVE-2026-56096Medium· 6.3PoCThe extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries
The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to e…
CVE-2026-56095High· 7.7The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object t…
The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object t…
CVE-2026-56093Medium· 6.3The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path
The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retriev…
CVE-2026-56092High· 7.6The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass exten…
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass exten…
CVE-2026-56094Medium· 6.3The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter
The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a…
CVE-2026-77127Medium· 6.0Information Disclosure in extension "Modules" (modules)
The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and…
CVE-2026-47344LowTYPO3 HTML Sanitizer allows Cross-site Scripting
TYPO3 HTML Sanitizer allows Cross-site Scripting
CVE-2026-47348MediumTYPO3 CMS has Cross-Site Scripting in Indexed Search
TYPO3 CMS has Cross-Site Scripting in Indexed Search
CVE-2026-47351MediumTYPO3 CMS: Broken Access Control in Media Module
TYPO3 CMS: Broken Access Control in Media Module
CVE-2026-47352MediumTYPO3 CMS has Broken Access Control in Backend API
TYPO3 CMS has Broken Access Control in Backend API
CVE-2026-49738LowTYPO3 CMS has Broken Access Control in its File Abstraction Layer
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
CVE-2026-49740MediumTYPO3 CMS has Insecure Deserialization via Core API
TYPO3 CMS has Insecure Deserialization via Core API
CVE-2026-49742HighTYPO3 CMS has Broken Access Control in its Media Module
TYPO3 CMS has Broken Access Control in its Media Module
CVE-2026-47346HighTYPO3 CMS has Broken Access Control in its Form Framework
TYPO3 CMS has Broken Access Control in its Form Framework
CVE-2026-47350MediumTYPO3 CMS has Broken Access Control in its DataHandler
TYPO3 CMS has Broken Access Control in its DataHandler
CVE-2026-49741HighTYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
CVE-2026-47345MediumTYPO3 HTML Sanitizer allows Cross-site Scripting
TYPO3 HTML Sanitizer allows Cross-site Scripting
CVE-2026-47343HighTYPO3 CMS: Destructive Actions on File Mount Folders
TYPO3 CMS: Destructive Actions on File Mount Folders
CVE-2026-47347MediumTYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
CVE-2026-47349MediumTYPO3 CMS has Broken Access Control in the Recycler Module
TYPO3 CMS has Broken Access Control in the Recycler Module
CVE-2026-11607HighTYPO3 CMS has Broken Access Control in its Form Framework
TYPO3 CMS has Broken Access Control in its Form Framework