Is CVE-2026-47351 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-47351 being exploited in the wild.

How severe is CVE-2026-47351?

Medium severity, with a CVSS score of 4, published 9 June 2026.

Which products and versions are affected?

typo3/cms-backend (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57; typo3/cms-core (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57.

Is there a fix for CVE-2026-47351?

Yes. typo3/cms-backend (Packagist): upgrade to 10.4.57 or later; typo3/cms-core (Packagist): upgrade to 10.4.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-47351 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-47351?

Check whether you run typo3/cms-backend (Packagist) or typo3/cms-core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-47351: TYPO3 CMS broken access control in Clipboard

CVE-2026-47351 · Severity: medium · CVSS 4 · Published 2026-06-09

TYPO3 CMS is a professional content management system used to build and manage websites. A security flaw in the system's clipboard functionality allowed authorized backend users to access information about files and records they were not supposed to see. This could lead to the exposure of sensitive internal data or administrative details to users with limited permissions.

Technologies: typo3/cms-backend (Packagist), typo3/cms-core (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-47351 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-47351 being exploited in the wild.
How severe is CVE-2026-47351?: Medium severity, with a CVSS score of 4, published 9 June 2026.
Which products and versions are affected?: typo3/cms-backend (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57; typo3/cms-core (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57.
Is there a fix for CVE-2026-47351?: Yes. typo3/cms-backend (Packagist): upgrade to 10.4.57 or later; typo3/cms-core (Packagist): upgrade to 10.4.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47351 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-47351?: Check whether you run typo3/cms-backend (Packagist) or typo3/cms-core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

typo3/cms-backend (Packagist): upgrade to 10.4.57 or later
```
composer require typo3/cms-backend:^10.4.57
```
typo3/cms-core (Packagist): upgrade to 10.4.57 or later
```
composer require typo3/cms-core:^10.4.57
```

Technical details

A broken access control vulnerability (CWE-862) exists in the TYPO3 CMS Media and Clipboard modules. Backend users with low privileges could insert arbitrary records and files into the system clipboard without the application performing proper read permission validation. This flaw allows an authenticated attacker to gather metadata or information about sensitive records and files that should be restricted based on their assigned roles. The issue is resolved in TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, and 14.3.3 LTS.

Affected products

TYPO3 TYPO3 CMS < 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, 14.0.0-14.3.2

Identifiers

CVE-2026-47351
GHSA-q93m-25xv-94hh

Timeline

2026-06-09: advisory: Initial advisory published by TYPO3 and NVD
2026-06-12: patched: GitHub Advisory Database entry updated with patch details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.