Most recent entries from all

certfr-2022-avi-549 — De multiples vulnérabilités ont été découvertes dans TYPO3. Elles permettent à un attaquant de provoquer un contourneme…

2026-10-08T13:32:19.258343+00:00

certfr-2022-avi-549

EUVD-2026-234042

2026-10-08T13:32:19.258401+00:00

EUVD-2026-234042

fkie_cve-2022-31047

2026-10-08T13:32:19.258431+00:00

TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception handlers, when logging the complete exception stack trace. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 contain a fix for the problem.

GHSA-fh99-4pgr-8j99 — Insertion of Sensitive Information into Log File in typo3/cms-core

2026-10-08T13:32:19.258489+00:00

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms

> ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9)

### Problem It has been discovered that system internal credentials or keys (e.g. database credentials) have been logged as plaintext in exception handlers, when logging the complete exception stack trace.

### Solution Update to TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, 11.5.11 that fix the problem described above.

### Credits Thanks to Marco Huber who reported this issue and to TYPO3 security member Torben Hansen who fixed the issue.

### References * [TYPO3-CORE-SA-2022-002](https://typo3.org/security/advisory/typo3-core-sa-2022-002)

gsd-2022-31047

2026-10-08T13:32:19.258552+00:00

gsd-2022-31047