Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
TYPO3 Form Framework Allows Malicious Code Injection
published 2 years ago
Summary
A critical issue in the TYPO3 Form Framework can allow hackers to inject malicious code into your website. This could allow them to steal sensitive information or take control of your site. Update your TYPO3 installation to the latest version to fix this vulnerability.
What to do
- Update typo3 cms to version 8.7.23.
- Update typo3 cms to version 9.5.4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | typo3 | cms |
>= 8.0.0, < 8.7.23 >= 9.0.0, < 9.5.4 Fix: upgrade to 8.7.23
|
Original advisory text
TYPO3 Cross-Site Scripting in Form Framework
Failing to properly encode user input, frontend forms handled by the form framework (system extension “form”) are vulnerable to cross-site scripting.
References
- https://github.com/TYPO3/typo3/commit/79528f75e23c2832db321f36d777c1427553f764
- https://github.com/TYPO3/typo3/commit/a0c4348188559596f292ea03983171bde29d9870
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-0...
- https://typo3.org/security/advisory/typo3-core-sa-2019-007
- https://github.com/advisories/GHSA-4h5c-5g25-v7fh
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published7 Jun 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
GHSA-4h5c-5g25-v7fh · GHSA
Track software like this
Free during beta