p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in typo3/cms-form

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für typo3/cms-form: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 8

  1. CVE-2026-15305

    Mittel · CVSS 6.3EPSS 0,25%Korrektur verfügbar

    TYPO3 CMS - Unrestricted File Upload in Form Framework

    Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

    typo3/cms-formPHP
    • Auf 14.3.5 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-49741

    Hoch · CVSS 8.7EPSS 0,24%Korrektur verfügbar

    TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework

    Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.

    typo3/cms-formPHP
    • Auf 14.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-47346

    Hoch · CVSS 7.6EPSS 0,25%Korrektur verfügbar

    TYPO3 CMS - Broken Access Control in Form Framework

    Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

    typo3/cms-form typo3/cms-form typo3/cms-form typo3/cms-form typo3/cms-formPHP
    • Auf 10.4.57 aktualisieren
    • Auf 11.5.51 aktualisieren
    • Auf 12.4.46 aktualisieren
    • Auf 13.4.31 aktualisieren
    • Auf 14.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-11607

    Hoch · CVSS 7.6EPSS 0,24%Korrektur verfügbar

    TYPO3 CMS - Broken Access Control in Form Framework

    Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

    typo3/cms-form typo3/cms-form typo3/cms-form typo3/cms-form typo3/cms-formPHP
    • Auf 10.4.57 aktualisieren
    • Auf 11.5.51 aktualisieren
    • Auf 12.4.46 aktualisieren
    • Auf 13.4.31 aktualisieren
    • Auf 14.3.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2024-55922

    Mittel · CVSS 5.4EPSS 0,2%Korrektur verfügbar

    Cross-Site Request Forgery in Form Framework Module in TYPO3

    TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following condi

    typo3/cms-form typo3/cms-form typo3/cms-form typo3/cms-formPHP
    • Auf 10.4.48 aktualisieren
    • Auf 11.5.42 aktualisieren
    • Auf 12.4.25 aktualisieren
    • Auf 13.4.3 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2021-21355

    Hoch · CVSS 8.6EPSS 1,63%Korrektur verfügbar

    Unrestricted File Upload in Form Framework

    TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, _UploadedFileReferenceConverter_ transforming uploaded files into proper FileReference domain model objects handles possible file uploads for other extensions as well - given those extensions use the Extbase MVC framework, make use of FileReference items in th

    typo3/cms-form typo3/cms-form typo3/cms-form typo3/cms-formPHP
    • Auf 10.4.14 aktualisieren
    • Auf 11.1.1 aktualisieren
    • Auf 8.7.40 aktualisieren
    • Auf 9.5.25 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2021-21357

    Hoch · CVSS 8.3EPSS 1,61%Korrektur verfügbar

    Broken Access Control in Form Framework

    TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. In the default configuration of the Form Framework this allows attackers to explicitly allow arbitrary mime-types for file uploads - however, default _fileDenyPattern_ successfully blocked files like _.htaccess_ or _malicious.php_. Besides that, attackers can persist those files in any writable directory of the corresponding TYPO3 installation. A val

    typo3/cms-form typo3/cms-form typo3/cms-form typo3/cms-formPHP
    • Auf 10.4.14 aktualisieren
    • Auf 11.1.1 aktualisieren
    • Auf 8.7.40 aktualisieren
    • Auf 9.5.25 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2021-21358

    Mittel · CVSS 5.4EPSS 0,87%Korrektur verfügbar

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form

    TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. This is fixed in versions 10.4.14, 11.1.1.

    typo3/cms-form typo3/cms-formPHP
    • Auf 10.4.14 aktualisieren
    • Auf 11.1.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →