TYPO3 11.5.16 and 10.4.32 security releases published

The following TYPO3 updates have been released: TYPO3 11.5.16 LTS TYPO3 10.4.32 LTS All versions are security releases and contain important security fixes - read the corresponding security advisories…

By-passing Cross-Site Scripting Protection in HTML Sanitizer

Component Type: TYPO3 CMS Subcomponent: HTML Sanitizer (based on typo3/html-sanitizer ) Release Date: September 13, 2022 Vulnerability Type: Cross-Site Scripting Affected Versions: 7.0.0-7.6.57,…

Cross-Site Scripting in <f:asset.css> view helper

Component Type: TYPO3 CMS Subcomponent: Fluid (ext:fluid) Release Date: September 13, 2022 Vulnerability Type: Cross-Site Scripting Affected Versions: 10.3.0-10.4.31, 11.0.0-11.5.15 Severity: Medium…

Stored Cross-Site Scripting via FileDumpController

Component Type: TYPO3 CMS Subcomponent: File Dump Controller (ext:core) Release Date: September 13, 2022 Vulnerability Type: Cross-Site Scripting Affected Versions: 7.0.0-7.6.57, 8.0.0-8.7.47,…

Missing check for expiration time of password reset token for backend users

Component Type: TYPO3 CMS Subcomponent: Password Reset (ext:backend) Release Date: September 13, 2022 Vulnerability Type: Broken Access Control Affected Versions: 10.4.0-10.4.31, 11.0.0-11.5.15…

User Enumeration via Response Timing

Component Type: TYPO3 CMS Subcomponent: User Authentication (ext:core) Release Date: September 13, 2022 Vulnerability Type: Information Disclosure Affected Versions: 7.0.0-7.6.57, 8.0.0-8.7.47,…

Denial of Service in Page Error Handling

Component Type: TYPO3 CMS Subcomponent: Page Error Handling (ext:core, ext:frontend) Release Date: September 13, 2022 Vulnerability Type: Denial of Service Affected Versions: 11.4.0-11.5.15 Severity:…

Introducing a New Way to Meet TYPO3

The official TYPO3 events are great and the community-organized TYPO3 camps are an amazing way to get to know the community. Still, we often forget to mention it when people from TYPO3 also…

Documentation Team—Summer Update 2022

TYPO3 Developers Days Several members of the Documentation Team attended this year's TYPO3 Developer Days. The coding night was a big success for us and we had several new contributors stop by to work…

TYPO3 Developer Days 2022 Recap

TYPO3 Education Committee—TCCE Certification Team Update

New, Obsolete And Updated Skills in TYPO3 V11 Every skill was internally discussed and then categorized according to different statuses, such as skill is new , skill is obsolete or skill has changed .…

Introducing the TYPO3 Content Blocks

The Structured Content Initiative is the core Strategic Initiative focused on improving the content editing user experience in TYPO3 CMS. Read our last update to learn more about what we’ve been…

TYPO3 11.5.15 maintenance release published

The following TYPO3 update has been released: TYPO3 11.5.15 LTS This version is a maintenance release and contains bug fixes only. Further upgrade instructions No database upgrades are required for…

typo3.org Website Team Report Q2, 2022

Sprints / t3o Remote Days The typo3.org team participated int the Community Sprint in Düsseldorf in April 2022. We held t3o Remote Days on: April 15th and 25th May 15th and 25th June 15th and 25th…

Happy 20th Birthday, TYPO3 Extension Repository

A Visionary Thing? It could be said that the TYPO3 Extension Repository was the first ever app marketplace in the world. The SUSE Linux distribution had a frontend for its own app repository in 1996.…

TYPO3 11.5.14 maintenance release published

The following TYPO3 update has been released: TYPO3 11.5.14 LTS This version is a maintenance release and contains bug fixes only. Further upgrade instructions No database upgrades are required for…

TYPO3 11.5.13 and 10.4.31 maintenance releases published

The following TYPO3 updates have been released: TYPO3 11.5.13 LTS TYPO3 10.4.31 LTS Further upgrade instructions No database upgrades are required for these maintenance releases. Download TYPO3 can be…

SQL Injection in extension "LUX - TYPO3 Marketing Automation" (lux)

Release Date: July 12, 2022 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "LUX - TYPO3 Marketing Automation" (lux) Composer Package…

TYPO3 Communication OKRs Initiative 2022/2023

Open Strategy Partners (OSP) is acting as Scrum master, and the project owner for the initiative is Mathias Bolt Lesniak. In the early months of 2022, the Board members participated in a series of…

TYPO3 Education Committee—TCCE Certification Team Update

Meet & Greet at TYPO3 Education Committee Sprint in Düsseldorf In Düsseldorf, we had six motivated team members, with contributors participating online and offline. Florian Weiss from SkillDisplay ,…

Growing Talent in the Job Market Desert

The call of businesses is strong and well-known—young tech talents are needed! But enticing a young audience to choose the path of IT and having them follow it isn’t a matter of throwing money around…

Information From the Budget Q&A

This article contains information from that meeting as well as some additional facts and considerations. Main Conclusions The Association Board and Business Control Committee (BCC) are sorry for the…

This Is Lina Wolf, the New Documentation Team Co-Lead

“After completing my computer science studies in 2006, I got a boring Java job,” says Lina. “But then I met someone who showed me TYPO3 and talked me into becoming a freelancer. That was around 2007,…

TYPO3 11.5.12 and 10.4.30 maintenance releases published

The following TYPO3 updates have been released: TYPO3 11.5.12 LTS TYPO3 10.4.30 LTS Further upgrade instructions No database upgrades are required for these maintenance releases. These releases aim to…

Insufficient Session Expiration in Admin Tool

Component Type: TYPO3 CMS Subcomponent: Admin Tool (ext:install) Release Date: June 14, 2022 Vulnerability Type: Broken Access Control Affected Versions: 9.0.0-9.5.34 ELTS, 10.0.0-10.4.28,…