https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T20:02:01.110994+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-0121 certfr-2024-avi-0121 — De multiples vulnérabilités ont été découvertes dans <span class="textit">les produits Typo3</span>. Certaines d'entre… 2026-10-16T20:02:01.115051+00:00 certfr-2024-avi-0121 https://cve.radiocsirt.org/vuln/euvd-2026-193467 EUVD-2026-193467 2026-10-16T20:02:01.115087+00:00 EUVD-2026-193467 https://cve.radiocsirt.org/vuln/fkie_cve-2024-22188 fkie_cve-2024-22188 2026-10-16T20:02:01.115101+00:00

TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.

 https://cve.radiocsirt.org/vuln/ghsa-5w2h-59j3-8x5w GHSA-5w2h-59j3-8x5w — TYPO3 Install Tool vulnerable to Code Execution 2026-10-16T20:02:01.115128+00:00

Affected: Packagist: typo3/cms-core

### Problem Several settings in the Install Tool for configuring the path to system binaries were vulnerable to code execution. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions.

The corresponding change for this advisory involves enforcing the known disadvantages described in [TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode](https://typo3.org/security/advisory/typo3-psa-2020-002).

### Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.

### Credits Thanks to Rickmer Frier & Daniel Jonka who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue.

### References * [TYPO3-CORE-SA-2024-002](https://typo3.org/security/advisory/typo3-core-sa-2024-002)

 https://cve.radiocsirt.org/vuln/gsd-2024-22188 gsd-2024-22188 2026-10-16T20:02:01.115161+00:00 gsd-2024-22188 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-0357 WID-SEC-W-2024-0357 — TYPO3 Core und TYPO3 Extension: Mehrere Schwachstellen 2026-10-16T20:02:01.115173+00:00

Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in TYPO3 Core und TYPO3 Extension ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder vertrauliche Informationen offenzulegen.