p PatchFirst

PatchFirst · Latest vulnerabilities

typo3/cms-core 14.3.3: known vulnerabilities

Known vulnerability affecting typo3/cms-core 14.3.3: 1. Compare the fixes below with your installed release.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerability: 1

  1. CVE-2026-19418

    High · CVSS 7.3EPSS 0.24%Fix available

    TYPO3 CMS - Broken Access Control in Backend and Install Tool

    The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. A

    typo3/cms-corePHP
    • Update to 14.3.6
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →