# Typo3 vulnerabilities Source: https://junglewise.ai/threats/vendors/typo3 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/typo3.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 47 vulnerabilities in Typo3: 0 in the last 7 days and 19 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-120331, was published on 3 November 2026. 8 vulnerabilities in the last four weeks, up 167% on the four before (3). 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 7 - Last 90 days: 19 - All time: 47 (0 critical, 0 exploited in the wild) ## About Typo3 TYPO3 is an open source web content management system. ## Latest Typo3 vulnerabilities - [CVE-2026-120331: TYPO3 Mail extension server-side request forgery](https://junglewise.ai/threats/cve-2026-120331-content-of-external-url-mails-their-stylesheets-and-images-to) (info, published 3 Nov 2026) - [CVE-2026-120329: TYPO3 Mail extension arbitrary page TSconfig write](https://junglewise.ai/threats/cve-2026-120329-saving-the-configuration-of-the-mail-backend-module-writes) (info, published 3 Nov 2026) - [CVE-2026-113468: TYPO3 Shop payment notification endpoint signature verification bypass](https://junglewise.ai/threats/cve-2026-113468-the-payment-notification-endpoint-for-paypal-accepts-incoming) (info, published 20 Oct 2026) - [CVE-2026-112238: TYPO3 File Manager SQL injection in search](https://junglewise.ai/threats/cve-2026-112238-the-file-search-of-the-extension-builds-its-database-conditions) (info, published 20 Oct 2026) - [CVE-2026-112237: TYPO3 Kitodo.Presentation server-side request forgery in proxy endpoint](https://junglewise.ai/threats/cve-2026-112237-the-extension-provides-a-public-proxy-endpoint-that-fetches-a) (info, published 20 Oct 2026) - [CVE-2026-112070: TYPO3 Analytics extension access control bypass in AJAX routes](https://junglewise.ai/threats/cve-2026-112070-the-ajax-routes-of-the-extension-do-not-check-whether-a-backend) (info, published 20 Oct 2026) - [CVE-2026-112067: TYPO3 Accessible Form Captcha CAPTCHA bypass in bw_captcha](https://junglewise.ai/threats/cve-2026-112067-the-extension-hides-the-correct-answer-to-each-captcha-inside) (info, published 20 Oct 2026) - [CVE-2026-109162: TYPO3 CMS FileUpload/ImageUpload storage bypass](https://junglewise.ai/threats/cve-2026-109162-forms-using-fileupload-or-imageupload-elements-with-a-custom) (info, published 13 Oct 2026) - [CVE-2026-107379: enshrined svg-sanitize denial of service via DTD attribute declaration](https://junglewise.ai/threats/cve-2026-107379-enshrined-svg-sanitize-denial-of-service-via-dtd-attribute) (medium, CVSS 6.5, published 8 Oct 2026) - [CVE-2023-50462: TYPO3 Content Consent extension insecure direct object reference](https://junglewise.ai/threats/cve-2023-50462-typo3-content-consent-extension-insecure-direct-object-reference) (medium, CVSS 5.3, published 14 Sep 2026) - [CVE-2023-50461: TYPO3 Direct Mail configuration injection in backend module](https://junglewise.ai/threats/cve-2023-50461-typo3-direct-mail-configuration-injection-in-backend-module) (high, CVSS 8.8, published 14 Sep 2026) - [CVE-2026-77139: TYPO3 Mask extension path traversal in template handling](https://junglewise.ai/threats/cve-2026-77139-typo3-mask-extension-path-traversal-in-template-handling) (info, CVSS 6.5, published 25 Aug 2026) - [CVE-2026-77138: TYPO3 HTML5 Video Player vs. Powermail extension remote code execution](https://junglewise.ai/threats/cve-2026-77138-typo3-html5-video-player-vs-powermail-extension-remote-code) (info, CVSS 9.8, published 25 Aug 2026) - [CVE-2026-77137: TYPO3 Forms Export SQL injection in backend module](https://junglewise.ai/threats/cve-2026-77137-typo3-forms-export-sql-injection-in-backend-module) (info, CVSS 7.3, published 25 Aug 2026) - [CVE-2026-77130: TYPO3 SYSSY insufficient JWT token expiration validation](https://junglewise.ai/threats/cve-2026-77130-typo3-syssy-insufficient-jwt-token-expiration-validation) (info, CVSS 5.7, published 25 Aug 2026) - [CVE-2026-77129: TYPO3 sf_event_mgt Server-Side Template Injection in email subject](https://junglewise.ai/threats/cve-2026-77129-typo3-sf-event-mgt-server-side-template-injection-in-email) (info, CVSS 7.1, published 25 Aug 2026) - [CVE-2026-77128: TYPO3 sf_event_mgt broken access control on event visibility](https://junglewise.ai/threats/cve-2026-77128-typo3-sf-event-mgt-broken-access-control-on-event-visibility) (info, CVSS 7.5, published 25 Aug 2026) - [CVE-2026-77127: TYPO3 Modules extension information disclosure in backend AJAX endpoint](https://junglewise.ai/threats/cve-2026-77127-typo3-modules-extension-information-disclosure-in-backend-ajax) (info, CVSS 6.5, published 25 Aug 2026) - [CVE-2026-56096: TYPO3 Apache Solr for TYPO3 information disclosure in search query](https://junglewise.ai/threats/cve-2026-56096-typo3-apache-solr-for-typo3-information-disclosure-in-search) (info, CVSS 7.5, published 25 Aug 2026) - [TYPO3 CMS broken access control in backend and install tool](https://junglewise.ai/threats/typo3-cms-broken-access-control-in-backend-and-install-tool-aa5ab01f) (high, CVSS 7.3, published 11 Aug 2026) - [CVE-2026-19418: The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started](https://junglewise.ai/threats/cve-2026-19418-typo3-cms-broken-access-control-in-backend-and-install-tool) (high, CVSS 4, published 11 Aug 2026) - [CVE-2026-15305: TYPO3 CMS unrestricted file upload in Form Framework](https://junglewise.ai/threats/cve-2026-15305-typo3-cms-unrestricted-file-upload-in-form-framework) (medium, CVSS 4, published 14 Jul 2026) - [CVE-2026-49742: TYPO3 CMS broken access control in Media Module](https://junglewise.ai/threats/cve-2026-49742-typo3-cms-broken-access-control-in-media-module) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-49741: TYPO3 CMS broken access control in Form Framework form_definition table](https://junglewise.ai/threats/cve-2026-49741-typo3-cms-broken-access-control-in-form-framework-form-definition) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-49740: TYPO3 CMS insecure deserialization in VariableFrontend and Registry](https://junglewise.ai/threats/cve-2026-49740-typo3-cms-insecure-deserialization-in-variablefrontend-and) (medium, CVSS 4, published 9 Jun 2026) ## Most severe Typo3 vulnerabilities - [CVE-2023-50461: TYPO3 Direct Mail configuration injection in backend module](https://junglewise.ai/threats/cve-2023-50461-typo3-direct-mail-configuration-injection-in-backend-module) (high, CVSS 8.8, published 14 Sep 2026) - [CVE-2016-5091: TYPO3 CMS missing access check in Extbase](https://junglewise.ai/threats/cve-2016-5091-typo3-cms-missing-access-check-in-extbase) (high, CVSS 8.1, published 23 Jan 2017) - [CVE-2026-6553: TYPO3 CMS Stores Cleartext Password in User Settings Module](https://junglewise.ai/threats/cve-2026-6553-typo3-cms-stores-cleartext-password-in-user-settings-module) (high, CVSS 7.5, published 21 Apr 2026) - [TYPO3 CMS broken access control in backend and install tool](https://junglewise.ai/threats/typo3-cms-broken-access-control-in-backend-and-install-tool-aa5ab01f) (high, CVSS 7.3, published 11 Aug 2026) - [CVE-2026-8727: TYPO3 Site Crawler insecure deserialization in X-T3Crawler-Meta header](https://junglewise.ai/threats/cve-2026-8727-typo3-site-crawler-insecure-deserialization-in-x-t3crawler-meta) (high, CVSS 4, published 19 May 2026) - [CVE-2026-8726: TYPO3 News system SQL injection in Date Menu plugin](https://junglewise.ai/threats/cve-2026-8726-typo3-news-system-sql-injection-in-date-menu-plugin) (high, CVSS 4, published 19 May 2026) - [CVE-2026-49742: TYPO3 CMS broken access control in Media Module](https://junglewise.ai/threats/cve-2026-49742-typo3-cms-broken-access-control-in-media-module) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-47346: TYPO3 CMS privilege escalation in Form Framework via mixed-case extensions](https://junglewise.ai/threats/cve-2026-47346-typo3-cms-privilege-escalation-in-form-framework-via-mixed-case) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-47343: TYPO3 CMS broken access control in File Abstraction Layer](https://junglewise.ai/threats/cve-2026-47343-typo3-cms-broken-access-control-in-file-abstraction-layer) (high, CVSS 4, published 9 Jun 2026) - [CVE-2026-8827: TYPO3 tt_address SQL injection in AddressRepository](https://junglewise.ai/threats/cve-2026-8827-typo3-tt-address-sql-injection-in-addressrepository) (high, CVSS 4, published 19 May 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up 167% on the four before (3). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 8 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 5 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Typo3 technologies - [TYPO3 CMS Core](https://junglewise.ai/threats/technologies/cms-core): 18 vulnerabilities - [Typo3](https://junglewise.ai/threats/technologies/typo3): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Typo3 vulnerabilities", https://junglewise.ai/threats/vendors/typo3, 13 November 2026.