Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

TYPO3 image handling can run unwanted code

CVE-2019-11832 · published 7 years ago
Summary

Versions of TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 let attackers execute their own code when the system processes images. The problem comes from how the software calls external image tools like ImageMagick or GraphicsMagick. Upgrade TYPO3 to the latest release or apply the provided security patch and verify the image tools are correctly configured.

What to do
  • Update typo3 cms-core to version 8.7.25.
  • Update typo3 cms-core to version 9.5.6.
  • Update typo3 cms to version 8.7.25.
  • Update typo3 cms to version 9.5.6.
Affected software
Ecosystem VendorProductAffected versions
composer typo3 cms-core >= 8.0.0, < 8.7.25
>= 9.0.0, < 9.5.6
Fix: upgrade to 8.7.25
composer typo3 cms >= 8.0.0, < 8.7.25
>= 9.0.0, < 9.5.6
Fix: upgrade to 8.7.25
– typo3 typo3 >= 8.0.0, < 8.7.25
>= 9.0.0, < 9.5.6
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
Original advisory text
TYPO3 Image Processing susceptible to Code Execution
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-94Code Injection
Timeline
Published9 May 2019
Updated23 Oct 2026
First seen6 Mar 2026
Sources
GHSA-3w4h-r27h-4r2w · GHSA
CVE-2019-11832 · NVD
Track software like this
Free during beta