Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

TYPO3 allows attackers to delete arbitrary files on the server

CVE-2011-4902 · published 7 years ago
Summary

TYPO3 content management software has a security issue that could allow an attacker to delete files on your website server. This is a serious issue because it could lead to data loss. To fix this, update to a version of TYPO3 that is not vulnerable, or use a patch if one is available.

What to do
  • Update typo3 cms to version 4.3.12.
  • Update typo3 cms to version 4.4.9.
  • Update typo3 cms to version 4.5.4.
Affected software
Ecosystem VendorProductAffected versions
composer typo3 cms < 4.3.12
>= 4.4.0, < 4.4.9
>= 4.5.0, < 4.5.4
Fix: upgrade to 4.3.12
– typo3 typo3 >= 4.3.0, < 4.3.12
>= 4.4.0, < 4.4.9
>= 4.5.0, < 4.5.4
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
Original advisory text
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published6 Nov 2019
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-9vxq-mxw5-mcgp · GHSA
CVE-2011-4902 · NVD
Track software like this
Free during beta