Broken Access Control in extension "femanager" (femanager)

Release Date: November 02, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "femanager" (femanager) Composer Package Name:…

TYPO3 11.5.18 maintenance release published

The following TYPO3 update has been released: TYPO3 11.5.18 LTS This version is a maintenance release and contains bug fixes only. Further upgrade instructions No database upgrades are required for…

Through the Looking Glass (or Being TYPO3 at DrupalCon)

At first, the difference was everywhere I looked. Everything was blue, not orange. Modules seemed to be everything, not just a backend thing. People talked about drops and pals . But then it dawned on…

Being TYPO3 at DMEXCO 2022

I went to Cologne on the second day of DMEXCO, a digital marketing expo and conference. It’s good to see in-person events gradually returning. It was very crowded, but some halls that had been used in…

TYPO3 11.5.19 maintenance release published

The following TYPO3 update has been released: TYPO3 11.5.19 LTS This version is a maintenance release and contains bug fixes only. It is worth mentioning that systems with a large amount of categories…

Status Report on Sustainability and the Buzzword Bingo From Boye 22

TYPO3 is a member of Boye & Co’s CMS Experts group . This is a forum where CMS analysts, thinkers, practitioners, experts, and vendors meet to discuss and share thoughts and ideas. I joined the…

Leadership Changes at TYPO3 GmbH

Being TYPO3 at SymfonyCon Disneyland, Paris

When I first entered the great exhibition hall, differences struck me at once. As did the volume! 1300 people all talking at the same time really creates an impressive noise. I saw people from all…

Denial of Service in Page Error Handling

Component Type: TYPO3 CMS Subcomponent: Page Error Handling (ext:core, ext:frontend) Release Date: December 13, 2022 Vulnerability Type: Denial of Service Affected Versions: 9.0.0-9.5.37,…

Weak Authentication in Frontend Login

Component Type: TYPO3 CMS Subcomponent: Frontend Login (ext:felogin, ext:frontend) Release Date: December 13, 2022 Vulnerability Type: Weak Authentication Affected Versions: 8.0.0-8.7.48,…

Insufficient Session Expiration after Password Reset

Component Type: TYPO3 CMS Subcomponent: Password Reset (ext:felogin, ext:backend) Release Date: December 13, 2022 Vulnerability Type: Insufficient Session Expiration Affected Versions: 10.0.0-10.4.32,…

Arbitrary Code Execution via Form Framework

Component Type: TYPO3 CMS Subcomponent: Form Framework (ext:form) Release Date: December 13, 2022 Vulnerability Type: Arbitrary Code Execution Affected Versions: 8.0.0-8.7.48, 9.0.0-9.5.37,…

Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

Component Type: TYPO3 CMS Subcomponent: Site Configuration, YAML File Loader (ext:core) Release Date: December 13, 2022 Vulnerability Type: Sensitive Information Disclosure Affected Versions:…

By-passing Cross-Site Scripting Protection in HTML Sanitizer

Component Type: TYPO3 CMS Subcomponent: HTML Sanitizer (based on typo3/html-sanitizer ) Release Date: December 13, 2022 Vulnerability Type: Cross-Site Scripting Affected Versions: 8.0.0-8.7.48,…

TYPO3 12.1.1, 11.5.20 and 10.4.33 security releases published

Regressions (especially in TYPO3 v10.4.33) introduced with these releases have been fixed in TYPO3 v12.1.3, v11.5.21 and v10.4.34 . Please use those versions instead. The following TYPO3 updates have…

Insufficient Session Expiration after Password Change in extension "Change password for frontend users" (fe_change_pwd)

Release Date: December 13, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Change password for frontend users" (fe_change_pwd)…

Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)

Release Date: December 13, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Newsletter subscriber management" (fp_newsletter)…

Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)

Release Date: December 13, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Master-Quiz" (fp_masterquiz) Composer Package Name:…

Strengthen the Project—Call for Budget Ideas

The call for budget ideas is open! All budget proposals must align with the goal, Strengthen the project . Submit your idea before 31 December 2022. Decisions will be announced at the end of January…

TYPO3 12.1.3, 11.5.21 and 10.4.34 maintenance releases published

The following TYPO3 updates have been released: TYPO3 12.1.3 TYPO3 11.5.21 LTS TYPO3 10.4.34 LTS Further upgrade instructions No database upgrades are required for these maintenance releases. These…

Announcing Official PHP 8.2 Support for Current TYPO3 Versions

Updated 10 January 2023: Added the section TYPO3 v11 LTS and PHP 8.2 Caveats With PostgreSQL . Read the PHP 8.2 Release Notes In the past months we worked hard, with both manual and automatic testing,…

TYPO3 11.5.22 maintenance release published

The following TYPO3 update has been released: TYPO3 11.5.22 LTS This version is a maintenance release and contains bug fixes only. Further upgrade instructions No database upgrades are required for…

T3BOARD23—TYPO3 Snowboard Tour Back in the Dolomites

T3BOARD is the longest running event of the TYPO3 universe—the first one was held back in 2001 in Bad Gastein, Austria. Visit the T3BOARD23 Website Hold. Your. Breath. 450 lifts and over 1200 km of…

Annual Report of the TYPO3 Expansion Committee, 2022

We learned a lot in 2019 - 2021 and had discussions with many companies — even governments. The Expansion Committee engaged with communities and web developers from many countries, and ran the TYPO3…

TYPO3 Community Writer’s Guide

The TYPO3 Community Language & Writing Guide is a resource for anyone in the TYPO3 community who is writing content for or about TYPO3 in an official capacity. You don’t have to read the guide to…