https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T01:43:28.615818+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2024-avi-0394 certfr-2024-avi-0394 — De multiples vulnérabilités ont été découvertes dans Typo3. Elles permettent à un attaquant de provoquer un déni de ser… 2026-10-10T01:43:28.619101+00:00 certfr-2024-avi-0394 https://cve.radiocsirt.org/vuln/euvd-2026-5491 EUVD-2026-5491 2026-10-10T01:43:28.619138+00:00 EUVD-2026-5491 https://cve.radiocsirt.org/vuln/fkie_cve-2024-34358 fkie_cve-2024-34358 2026-10-10T01:43:28.619153+00:00

TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1, the `ShowImageController` (`_eID tx_cms_showpic_`) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 fix the problem described.

 https://cve.radiocsirt.org/vuln/ghsa-36g8-62qv-5957 GHSA-36g8-62qv-5957 — TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController 2026-10-10T01:43:28.619184+00:00

Affected: Packagist: typo3/cms-core

### Problem The `ShowImageController` (_eID tx_cms_showpic_) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side.

### Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.

#### ℹ️ **Strong security defaults - Manual actions required**

The `frame` HTTP query parameter is now ignored, since it could not be used by core APIs.

The new feature flag `security.frontend.allowInsecureFrameOptionInShowImageController` – which is disabled per default – can be used to reactivate the previous behavior.

### Credits Thanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core & security team members Benjamin Mack and Benjamin Franzke who fixed the issue.

### References * [TYPO3-CORE-SA-2024-010](https://typo3.org/security/advisory/typo3-core-sa-2024-010)

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1112 WID-SEC-W-2024-1112 — TYPO3 Core: Mehrere Schwachstellen 2026-10-10T01:43:28.619238+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen oder einen Denial-of-Service-Zustand zu verursachen.