Elias Häußler

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this allowed them, for example, to gain system maintainer privileges or cause a denial of service. Exploiting this vulnerability requires an administrator-level backend user account. This issue affects TYPO3 CMS versions 14.2.0-14.3.6.

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions prior to 10.4.57 TYPO3 CMS versions 11.0.0 through 11.5.50 TYPO3 CMS versions 12.0.0 through 12.4.45 TYPO3 CMS versions 13.0.0 through 13.4.30 TYPO3 CMS versions 14.0.0 through 14.3.2 **Description** Non-privileged backend users with file mount access can perform unauthorized write operations, including moving, deleting, and renaming folders that represent the root of an active file mount, due to missing authorization restrictions. **Recommendations** Update to version 10.4.57 or later. Update to version 11.5.51 or later. Update to version 12.4.46 or later. Update to version 13.4.31 or later. Update to version 14.3.3 or later.

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions 10.4.0 through 13.4.30 TYPO3 CMS versions 14.0.0 through 14.3.2 **Description** Backend users can insert arbitrary records and files into the clipboard without proper read permission checks. This allows unauthorized users to gather information about records and files they are not permitted to view. **Recommendations** Update TYPO3 CMS versions 10.4.0 through 13.4.30 to a version newer than 13.4.30. Update TYPO3 CMS versions 14.0.0 through 14.3.2 to a version newer than 14.3.2.

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions prior to 10.4.57 TYPO3 CMS versions 11.0.0 through 11.5.51 TYPO3 CMS versions 12.0.0 through 12.4.46 TYPO3 CMS versions 13.0.0 through 13.4.31 TYPO3 CMS versions 14.0.0 through 14.3.3 **Description** Backend users with access to the Recycler module can restore soft-deleted records on pages or for tables they are not authorized to modify. **Recommendations** Update to version 10.4.57 or later. Update to version 11.5.52 or later. Update to version 12.4.47 or later. Update to version 13.4.32 or later. Update to version 14.3.4 or later. As a temporary workaround, restrict access to the Recycler module for unauthorized users.

**Name of the Vulnerable Software and Affected Versions** TYPO3 (affected versions not specified) **Description** The extension does not correctly define allowed classes when deserializing transport failure metadata. This can be exploited by an attacker to execute untrusted serialized code. An active exploit requires write access to the directory configured at `$GLOBALS['TYPO3 CONF VARS']['MAIL']['transport spool filepath']`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TYPO3 FileSpool Extension (affected versions not specified) **Description** The FileSpool extension for TYPO3 contains a flaw related to Insecure Deserialization. The extension’s code, derived from the TYPO3 core, reintroduces a previously addressed issue, even when the core TYPO3 system is updated. This occurs because the extension incorporates the vulnerable code that was originally fixed in the TYPO3 core. The issue is linked to the TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 10.0.0 through 10.4.54 TYPO3 versions 11.0.0 through 11.5.48 TYPO3 versions 12.0.0 through 12.4.40 TYPO3 versions 13.0.0 through 13.4.22 TYPO3 versions 14.0.0 through 14.0.1 **Description** A flaw exists in TYPO3 that allows local users with write access to the spool directory to execute arbitrary PHP code on the web server. This is possible by crafting a malicious file that is deserialized during the `mailer:spool:send` command. **Recommendations** Update TYPO3 versions to a version later than 10.4.54. Update TYPO3 versions to a version later than 11.5.48. Update TYPO3 versions to a version later than 12.4.40. Update TYPO3 versions to a version later than 13.4.22. Update TYPO3 versions to a version later than 14.0.1.

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions 10.0.0 through 10.4.54 TYPO3 CMS versions 11.0.0 through 11.5.48 TYPO3 CMS versions 12.0.0 through 12.4.40 TYPO3 CMS versions 13.0.0 through 13.4.22 TYPO3 CMS versions 14.0.0 through 14.0.1 **Description** Backend users with access to the recycler module could delete arbitrary data from any database table defined in the TCA, irrespective of their permissions for that specific table. This allowed attackers to purge and destroy critical site data, potentially rendering the website unavailable. The issue concerns the TYPO3 CMS recycler module and its interaction with the TCA (TypoScript Configuration Array). **Recommendations** TYPO3 CMS versions 10.0.0 through 10.4.54 should be updated to a newer, fixed version. TYPO3 CMS versions 11.0.0 through 11.5.48 should be updated to a newer, fixed version. TYPO3 CMS versions 12.0.0 through 12.4.40 should be updated to a newer, fixed version. TYPO3 CMS versions 13.0.0 through 13.4.22 should be updated to a newer, fixed version. TYPO3 CMS versions 14.0.0 through 14.0.1 should be updated to a newer, fixed version.

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions 10.0.0 through 10.4.54 TYPO3 CMS versions 11.0.0 through 11.5.48 TYPO3 CMS versions 12.0.0 through 12.4.40 TYPO3 CMS versions 13.0.0 through 13.4.22 TYPO3 CMS versions 14.0.0 through 14.0.1 **Description** Users with backend access to the redirects module and write permission on the `sys redirect` table could read, create, and modify any redirect record without restrictions. This allowed for the insertion or alteration of redirects pointing to arbitrary URLs, potentially enabling phishing or other malicious redirect attacks. **Recommendations** TYPO3 CMS versions 10.0.0 through 10.4.54 should be updated. TYPO3 CMS versions 11.0.0 through 11.5.48 should be updated. TYPO3 CMS versions 12.0.0 through 12.4.40 should be updated. TYPO3 CMS versions 13.0.0 through 13.4.22 should be updated. TYPO3 CMS versions 14.0.0 through 14.0.1 should be updated.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.54 TYPO3 CMS versions 10.0.0 through 10.4.53 TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: The Backend Routing component lacks proper authorization checks. This allows backend users to directly invoke AJAX backend routes without the necessary access permissions to the corresponding backend modules. Recommendations: TYPO3 CMS versions 9.0.0 through 9.5.54: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 10.0.0 through 10.4.53: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 11.0.0 through 11.5.47: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 12.0.0 through 12.4.36: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 13.0.0 through 13.4.17: At the moment, there is no information about a newer version that contains a fix for this vulnerability.