CVE-2026-19418: The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started

CVE-2026-19418 · Severity: high · CVSS 4 · Published 2026-08-11

TYPO3 is a widely-used enterprise content management system that powers websites and manages digital content. A flaw in its referrer validation logic allows an attacker who can inject JavaScript code into a TYPO3-hosted website (for example through a cross-site scripting vulnerability) to make unauthorized requests to the backend and Install Tool on behalf of a logged-in administrator. This could enable the attacker to modify website content, change configurations, or gain administrative access without proper authentication.

Technologies: typo3/cms-backend (Packagist), typo3/cms-core (Packagist). Vendors: Packagist, Typo3.

Quick answers

Is CVE-2026-19418 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-19418 being exploited in the wild.
How severe is CVE-2026-19418?
High severity, with a CVSS score of 4, published 11 August 2026.
Which products and versions are affected?
typo3/cms-backend (Packagist) >= 13.0.0, < 13.4.34, ECOSYSTEM:introduced=13.0.0,fixed=13.4.34; typo3/cms-core (Packagist) >= 14.0.0, < 14.3.6, ECOSYSTEM:introduced=14.0.0,fixed=14.3.6; TYPO3 CMS Install Tool 13.0.0 to 13.4.33, 14.0.0 to 14.3.5.
Is there a fix for CVE-2026-19418?
Yes. typo3/cms-backend (Packagist): upgrade to 13.4.34 or later; typo3/cms-core (Packagist): upgrade to 14.3.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-19418 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-19418?
Check whether you run typo3/cms-backend (Packagist), typo3/cms-core (Packagist) or TYPO3 CMS Install Tool at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • typo3/cms-backend (Packagist): upgrade to 13.4.34 or later
    composer require typo3/cms-backend:^13.4.34
  • typo3/cms-core (Packagist): upgrade to 14.3.6 or later
    composer require typo3/cms-core:^14.3.6

Technical details

The vulnerability is an origin validation error (CWE-346) and CSRF-like attack (CWE-352) affecting TYPO3's ReferrerEnforcer component. The root cause: in TYPO3 v13.0+, the backend application was moved from a dedicated typo3/ subdirectory to the document root, served via index.php. The referrer validation logic continued to check if requests originated from the backend by comparing the referrer directory against the entry script location—but since both are now at the site root, any request with a referrer from the same domain passes validation. An attacker who can execute JavaScript on any page of a TYPO3 instance (via XSS) can invoke backend or Install Tool endpoints using Fetch/XHR APIs with a logged-in user's session cookies, requiring the user to be already authenticated. The attack is network-accessible and requires low privilege (user authentication) and active user interaction. Fixes are available in TYPO3 versions 13.4.34 LTS and 14.3.6 LTS, which refine the referrer enforcement to account for concrete URI details.

Affected products

  • TYPO3 TYPO3 CMS Backend 13.0.0 to 13.4.33, 14.0.0 to 14.3.5
  • TYPO3 TYPO3 CMS Core 13.0.0 to 13.4.33, 14.0.0 to 14.3.5
  • TYPO3 TYPO3 CMS Install Tool 13.0.0 to 13.4.33, 14.0.0 to 14.3.5

Identifiers

  • CVE-2026-19418
  • GHSA-68jx-f42c-7599

Timeline

  • 2026-09-01: disclosed: Published via GitHub Advisory Database
  • 2026-09-01: patched: Fixed in TYPO3 13.4.34 LTS and 14.3.6 LTS

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.