Elias Häußler

Backend administrators lacking system maintainer privileges can schedule the `configuration:read`, `configuration:set`, and `configuration:show` commands. This allows for the modification of arbitrary system configurations typically restricted to system maintainers, potentially leading to the escalation of privileges to system maintainer level or a denial of service. Exploitation requires an account with administrator-level backend access.

Non-privileged backend users with file mount access can perform unauthorized write operations, including moving, deleting, and renaming folders that represent the root of an active file mount, due to missing authorization restrictions.

Backend users can insert arbitrary records and files into the clipboard without proper read permission checks. This allows unauthorized users to gather information about records and files they are not permitted to view.

Backend users with access to the Recycler module can restore soft-deleted records on pages or for tables they are not authorized to modify.

The extension does not correctly define allowed classes when deserializing transport failure metadata. This can be exploited by an attacker to execute untrusted serialized code. An active exploit requires write access to the directory configured at `$GLOBALS['TYPO3 CONF VARS']['MAIL']['transport spool filepath']`.

The FileSpool extension for TYPO3 contains a flaw related to Insecure Deserialization. The extension’s code, derived from the TYPO3 core, reintroduces a previously addressed issue, even when the core TYPO3 system is updated. This occurs because the extension incorporates the vulnerable code that was originally fixed in the TYPO3 core. The issue is linked to the TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-004.

A flaw exists in TYPO3 that allows local users with write access to the spool directory to execute arbitrary PHP code on the web server. This is possible by crafting a malicious file that is deserialized during the `mailer:spool:send` command.

Backend users with access to the recycler module could delete arbitrary data from any database table defined in the TCA, irrespective of their permissions for that specific table. This allowed attackers to purge and destroy critical site data, potentially rendering the website unavailable. The issue concerns the TYPO3 CMS recycler module and its interaction with the TCA (TypoScript Configuration Array).

Users with backend access to the redirects module and write permission on the `sys redirect` table could read, create, and modify any redirect record without restrictions. This allowed for the insertion or alteration of redirects pointing to arbitrary URLs, potentially enabling phishing or other malicious redirect attacks.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.54 TYPO3 CMS versions 10.0.0 through 10.4.53 TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: The Backend Routing component lacks proper authorization checks. This allows backend users to directly invoke AJAX backend routes without the necessary access permissions to the corresponding backend modules. Recommendations: TYPO3 CMS versions 9.0.0 through 9.5.54: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 10.0.0 through 10.4.53: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 11.0.0 through 11.5.47: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 12.0.0 through 12.4.36: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 13.0.0 through 13.4.17: At the moment, there is no information about a newer version that contains a fix for this vulnerability.