Most recent entries from all

bdu:2025-06004

certfr-2025-avi-0429 — De multiples vulnérabilités ont été découvertes dans les produits Typo3. Certaines d'entre elles permettent à un attaqu…

certfr-2025-avi-0429

EUVD-2026-240197

fkie_cve-2025-47937

TYPO3 is an open source, PHP based web content management system. Starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, when performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the first table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

GHSA-x8pv-fgxp-8v3x — TYPO3 Allows Information Disclosure via DBAL Restriction Handling

Affected: Packagist: typo3/cms-core

### Problem When performing a database query involving multiple tables through the database abstraction layer (DBAL), frontend user permissions are only applied via `FrontendGroupRestriction` to the last table. As a result, data from additional tables included in the same query may be unintentionally exposed to unauthorized users.

### Solution Update to TYPO3 versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, 13.4.12 LTS that fix the problem described.

### Credits Thanks to Christian Futterlieb for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it.

WID-SEC-W-2025-1106 — TYPO3 Core: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um Dateien zu manipulieren, Informationen auszuspähen, Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service auszulösen oder seine Privilegien zu erweitern.