https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T05:20:04.178795+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0722 certfr-2026-avi-0722 — De multiples vulnérabilités ont été découvertes dans Typo3. Certaines d'entre elles permettent à un attaquant de provoq… 2026-10-03T05:20:04.230889+00:00 certfr-2026-avi-0722 https://cve.radiocsirt.org/vuln/euvd-2026-337869 EUVD-2026-337869 2026-10-03T05:20:04.230930+00:00 EUVD-2026-337869 https://cve.radiocsirt.org/vuln/fkie_cve-2026-47352 fkie_cve-2026-47352 2026-10-03T05:20:04.230945+00:00

Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

 https://cve.radiocsirt.org/vuln/ghsa-2j54-93q2-3hjq GHSA-2j54-93q2-3hjq — TYPO3 CMS has Broken Access Control in Backend API 2026-10-03T05:20:04.230974+00:00

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms-backend

### Problem Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages.

### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

### Credits TYPO3 CMS thanks Phong Lan for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.

### Resources * [TYPO3-CORE-SA-2026-015](https://typo3.org/security/advisory/typo3-core-sa-2026-015)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1835 WID-SEC-W-2026-1835 — TYPO3 Core: Mehrere Schwachstellen 2026-10-03T05:20:04.231009+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Sicherheitsbeschränkungen zu umgehen, Benutzer auf schädliche Websites umzuleiten, beliebigen Code auszuführen, Berechtigungen zu eskalieren oder andere Auswirkungen zu verursachen.