# TYPO3 CMS Core vulnerabilities Source: https://junglewise.ai/threats/technologies/cms-core Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/cms-core.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 18 vulnerabilities in TYPO3 CMS Core: 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, TYPO3 CMS broken access control in backend and install tool, was published on 11 August 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 18 (0 critical, 0 exploited in the wild) ## About TYPO3 CMS Core The central framework and core components of the TYPO3 content management system. ## Latest TYPO3 CMS Core vulnerabilities - [TYPO3 CMS broken access control in backend and install tool](https://junglewise.ai/threats/typo3-cms-broken-access-control-in-backend-and-install-tool-aa5ab01f) (high, CVSS 7.3, published 11 Aug 2026) - [CVE-2026-49742: TYPO3 CMS broken access control in Media Module](https://junglewise.ai/threats/cve-2026-49742-typo3-cms-broken-access-control-in-media-module) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-49741: TYPO3 CMS broken access control in Form Framework form_definition table](https://junglewise.ai/threats/cve-2026-49741-typo3-cms-broken-access-control-in-form-framework-form-definition) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-49740: TYPO3 CMS insecure deserialization in VariableFrontend and Registry](https://junglewise.ai/threats/cve-2026-49740-typo3-cms-insecure-deserialization-in-variablefrontend-and) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-49738: TYPO3 CMS path traversal in GeneralUtility::isAllowedAbsPath](https://junglewise.ai/threats/cve-2026-49738-typo3-cms-path-traversal-in-generalutility-isallowedabspath) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47352: TYPO3 CMS broken access control in Backend API](https://junglewise.ai/threats/cve-2026-47352-typo3-cms-broken-access-control-in-backend-api) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47351: TYPO3 CMS broken access control in Clipboard](https://junglewise.ai/threats/cve-2026-47351-typo3-cms-broken-access-control-in-clipboard) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47350: TYPO3 CMS broken access control in DataHandler](https://junglewise.ai/threats/cve-2026-47350-typo3-cms-broken-access-control-in-datahandler) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47349: TYPO3 CMS missing authorization in Recycler module](https://junglewise.ai/threats/cve-2026-47349-typo3-cms-missing-authorization-in-recycler-module) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47348: TYPO3 CMS XSS in Indexed Search component](https://junglewise.ai/threats/cve-2026-47348-typo3-cms-xss-in-indexed-search-component) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47347: TYPO3 CMS open redirect in GeneralUtility::sanitizeLocalUrl](https://junglewise.ai/threats/cve-2026-47347-typo3-cms-open-redirect-in-generalutility-sanitizelocalurl) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-47346: TYPO3 CMS privilege escalation in Form Framework via mixed-case extensions](https://junglewise.ai/threats/cve-2026-47346-typo3-cms-privilege-escalation-in-form-framework-via-mixed-case) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-47343: TYPO3 CMS broken access control in File Abstraction Layer](https://junglewise.ai/threats/cve-2026-47343-typo3-cms-broken-access-control-in-file-abstraction-layer) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-11607: TYPO3 CMS privilege escalation in Form Framework](https://junglewise.ai/threats/cve-2026-11607-typo3-cms-privilege-escalation-in-form-framework) (high, CVSS 4, published 9 Jun 2026) - [CVE-2018-17960: CKEditor 4 XSS in source mode paste](https://junglewise.ai/threats/cve-2018-17960-ckeditor-4-xss-in-source-mode-paste) (low, CVSS 3, published 21 Nov 2018) - [CVE-2018-14041: Bootstrap cross-site scripting in scrollspy data-target](https://junglewise.ai/threats/cve-2018-14041-bootstrap-cross-site-scripting-in-scrollspy-data-target) (low, CVSS 3, published 13 Sep 2018) - [CVE-2016-5091: TYPO3 CMS missing access check in Extbase](https://junglewise.ai/threats/cve-2016-5091-typo3-cms-missing-access-check-in-extbase) (high, CVSS 8.1, published 23 Jan 2017) - [CVE-2016-4056: TYPO3 CMS stored XSS in Backend bookmark toolbar](https://junglewise.ai/threats/cve-2016-4056-typo3-cms-stored-xss-in-backend-bookmark-toolbar) (medium, CVSS 6.1, published 23 Jan 2017) ## Most severe TYPO3 CMS Core vulnerabilities - [CVE-2016-5091: TYPO3 CMS missing access check in Extbase](https://junglewise.ai/threats/cve-2016-5091-typo3-cms-missing-access-check-in-extbase) (high, CVSS 8.1, published 23 Jan 2017) - [TYPO3 CMS broken access control in backend and install tool](https://junglewise.ai/threats/typo3-cms-broken-access-control-in-backend-and-install-tool-aa5ab01f) (high, CVSS 7.3, published 11 Aug 2026) - [CVE-2026-49742: TYPO3 CMS broken access control in Media Module](https://junglewise.ai/threats/cve-2026-49742-typo3-cms-broken-access-control-in-media-module) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-47346: TYPO3 CMS privilege escalation in Form Framework via mixed-case extensions](https://junglewise.ai/threats/cve-2026-47346-typo3-cms-privilege-escalation-in-form-framework-via-mixed-case) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-47343: TYPO3 CMS broken access control in File Abstraction Layer](https://junglewise.ai/threats/cve-2026-47343-typo3-cms-broken-access-control-in-file-abstraction-layer) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-49741: TYPO3 CMS broken access control in Form Framework form_definition table](https://junglewise.ai/threats/cve-2026-49741-typo3-cms-broken-access-control-in-form-framework-form-definition) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-11607: TYPO3 CMS privilege escalation in Form Framework](https://junglewise.ai/threats/cve-2026-11607-typo3-cms-privilege-escalation-in-form-framework) (high, CVSS 4, published 9 Jun 2026) - [CVE-2016-4056: TYPO3 CMS stored XSS in Backend bookmark toolbar](https://junglewise.ai/threats/cve-2016-4056-typo3-cms-stored-xss-in-backend-bookmark-toolbar) (medium, CVSS 6.1, published 23 Jan 2017) - [CVE-2026-49740: TYPO3 CMS insecure deserialization in VariableFrontend and Registry](https://junglewise.ai/threats/cve-2026-49740-typo3-cms-insecure-deserialization-in-variablefrontend-and) (medium, CVSS 4, published 9 Jun 2026) - [CVE-2026-49738: TYPO3 CMS path traversal in GeneralUtility::isAllowedAbsPath](https://junglewise.ai/threats/cve-2026-49738-typo3-cms-path-traversal-in-generalutility-isallowedabspath) (medium, CVSS 4, published 9 Jun 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Typo3 technologies - [Typo3](https://junglewise.ai/threats/technologies/typo3): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "TYPO3 CMS Core vulnerabilities", https://junglewise.ai/threats/technologies/cms-core, 10 November 2026.