Strengthen the Project—Call for Budget Ideas

The call for budget ideas is open! All budget proposals must align with the goal, Strengthen the project . Submit your idea before 31 December 2022. Decisions will be announced at the end of January…

Multiple vulnerabilities in extension "Master-Quiz" (fp_masterquiz)

Release Date: December 13, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Master-Quiz" (fp_masterquiz) Composer Package Name:…

Multiple vulnerabilities in extension "Newsletter subscriber management" (fp_newsletter)

Release Date: December 13, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Newsletter subscriber management" (fp_newsletter)…

Insufficient Session Expiration after Password Change in extension "Change password for frontend users" (fe_change_pwd)

Release Date: December 13, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Change password for frontend users" (fe_change_pwd)…

TYPO3 12.1.1, 11.5.20 and 10.4.33 security releases published

Regressions (especially in TYPO3 v10.4.33) introduced with these releases have been fixed in TYPO3 v12.1.3, v11.5.21 and v10.4.34 . Please use those versions instead. The following TYPO3 updates have…

By-passing Cross-Site Scripting Protection in HTML Sanitizer

Component Type: TYPO3 CMS Subcomponent: HTML Sanitizer (based on typo3/html-sanitizer ) Release Date: December 13, 2022 Vulnerability Type: Cross-Site Scripting Affected Versions: 8.0.0-8.7.48,…

Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

Component Type: TYPO3 CMS Subcomponent: Site Configuration, YAML File Loader (ext:core) Release Date: December 13, 2022 Vulnerability Type: Sensitive Information Disclosure Affected Versions:…

Arbitrary Code Execution via Form Framework

Component Type: TYPO3 CMS Subcomponent: Form Framework (ext:form) Release Date: December 13, 2022 Vulnerability Type: Arbitrary Code Execution Affected Versions: 8.0.0-8.7.48, 9.0.0-9.5.37,…

Insufficient Session Expiration after Password Reset

Component Type: TYPO3 CMS Subcomponent: Password Reset (ext:felogin, ext:backend) Release Date: December 13, 2022 Vulnerability Type: Insufficient Session Expiration Affected Versions: 10.0.0-10.4.32,…

Weak Authentication in Frontend Login

Component Type: TYPO3 CMS Subcomponent: Frontend Login (ext:felogin, ext:frontend) Release Date: December 13, 2022 Vulnerability Type: Weak Authentication Affected Versions: 8.0.0-8.7.48,…

Denial of Service in Page Error Handling

Component Type: TYPO3 CMS Subcomponent: Page Error Handling (ext:core, ext:frontend) Release Date: December 13, 2022 Vulnerability Type: Denial of Service Affected Versions: 9.0.0-9.5.37,…

Being TYPO3 at SymfonyCon Disneyland, Paris

When I first entered the great exhibition hall, differences struck me at once. As did the volume! 1300 people all talking at the same time really creates an impressive noise. I saw people from all…

Leadership Changes at TYPO3 GmbH

Status Report on Sustainability and the Buzzword Bingo From Boye 22

TYPO3 is a member of Boye & Co’s CMS Experts group . This is a forum where CMS analysts, thinkers, practitioners, experts, and vendors meet to discuss and share thoughts and ideas. I joined the…

TYPO3 11.5.19 maintenance release published

The following TYPO3 update has been released: TYPO3 11.5.19 LTS This version is a maintenance release and contains bug fixes only. It is worth mentioning that systems with a large amount of categories…

Being TYPO3 at DMEXCO 2022

I went to Cologne on the second day of DMEXCO, a digital marketing expo and conference. It’s good to see in-person events gradually returning. It was very crowded, but some halls that had been used in…

Through the Looking Glass (or Being TYPO3 at DrupalCon)

At first, the difference was everywhere I looked. Everything was blue, not orange. Modules seemed to be everything, not just a backend thing. People talked about drops and pals . But then it dawned on…

TYPO3 11.5.18 maintenance release published

The following TYPO3 update has been released: TYPO3 11.5.18 LTS This version is a maintenance release and contains bug fixes only. Further upgrade instructions No database upgrades are required for…

Broken Access Control in extension "femanager" (femanager)

Release Date: November 02, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "femanager" (femanager) Composer Package Name:…

UX and TYPO3—the Challenges for the Next Five Years

Who Is Involved In Improving TYPO3 Backend UX? Actually, a lot of people! The obvious answer is the Core Team. But really all the TYPO3 Teams and Initiatives impact the product UX and UI. And let’s…

Teaming Up For Better Extensions

Benefits From Becoming a Team Becoming an official team means that we now have a new team page typo3.org, The TYPO3 Best Practices Team . This lets us share all the information about our team,…

TYPO3 11.5.17 maintenance release published

The following TYPO3 update has been released: TYPO3 11.5.17 LTS This version is a maintenance release and contains bug fixes only. Further upgrade instructions No database upgrades are required for…

TYPO3 Education Committee: TCCE Certification Team Final Update

Sprint at Web-vision in Mönchengladbach With the syllabus being up-to-date, the documentation fixed and the NDA prepared, we agreed on a team sprint in Mönchengladbach, Germany. There, Oliver Thiele…

Server Team Status Report — September 2022

The other main call on our time is actioning requests from former community members who want their data destroyed (according to the terms of the GDPR) from all systems within the TYPO3 universe.…

Get Ready for TYPO3 v12

One of the main goals of the TYPO3 v12 series is speed. That’s right! We will step hard on the gas pedal and increase the performance compared to previous versions of our open-source enterprise…