Report From the Best Practices Remote Day April 2025

About the Best Practices Team The team currently provides the Tea example (tea) extension , which serves as an example on how to write an Extbase extension following best practices. The main focus is…

Winning Votes With TYPO3: A Guide to Content Management for Political Parties

Using TYPO3 for Small Projects Pt.1

Multiple vulnerabilities in extension "Front End User Registration" (sr_feuser_register)

Release Date: May 20, 2025 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Front End User Registration" (sr_feuser_register) Composer…

Multiple vulnerabilities in extension "Backup Plus" (ns_backup)

Release Date: May 20, 2025 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Backup Plus" (ns_backup) Composer Package Name:…

Insecure Direct Object Reference in extension "femanager" (femanager)

Release Date: May 20, 2025 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "femanager" (femanager) Composer Package Name:…

Cross-Site Scripting in extension "[clickstorm] SEO" (cs_seo)

Release Date: May 20, 2025 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "[clickstorm] SEO" (cs_seo) Composer Package Name:…

Insecure Direct Object Reference in extension "Download manager" (reint_downloadmanager)

Release Date: May 20, 2025 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Download manager" (reint_downloadmanager) Composer Package…

TYPO3 Trademark Usage: What’s Allowed and What’s Not

The TYPO3 name is more than a label — it represents a global open-source community, a rock-solid CMS, and decades of shared innovation. As the TYPO3 ecosystem continues to grow, we want to make sure…

TYPO3 13.4.12 and 12.4.31 security releases published

The following TYPO3 updates have been released: TYPO3 13.4.12 LTS TYPO3 12.4.31 LTS All versions are security releases and contain important security fixes - read the corresponding security advisories…

Privilege Escalation to System Maintainer

Component Type: TYPO3 CMS Subcomponent: DataHandler (ext:core) Release Date: May 20, 2025 Vulnerability Type: Broken Authentication Affected Versions: 10.4.0-10.4.49, 11.0.0-11.5.43, 12.0.0-12.4.30,…

Broken Authentication in Backend MFA

Component Type: TYPO3 CMS Subcomponent: Session Handling (ext:backend) Release Date: May 20, 2025 Vulnerability Type: Broken Authentication Affected Versions: 12.0.0-12.4.30, 13.0.0-13.4.11 Severity:…

Unrestricted File Upload in File Abstraction Layer

Component Type: TYPO3 CMS Subcomponent: File Abstraction Layer (ext:core) Release Date: May 20, 2025 Vulnerability Type: Security Misconfiguration Affected Versions: 9.0.0-9.5.50, 10.0.0-10.4.49,…

Unverified Password Change for Backend Users

Component Type: TYPO3 CMS Subcomponent: DataHandler & Setup Module (ext:core, ext:setup) Release Date: May 20, 2025 Vulnerability Type: Security Misconfiguration Affected Versions: 9.0.0-9.5.50,…

Server-Side Request Forgery via Webhooks

Component Type: TYPO3 CMS Subcomponent: Webhooks (ext:webhooks) Release Date: May 20, 2025 Vulnerability Type: Server-Side Request Forgery Affected Versions: 12.0.0-12.4.30, 13.0.0-13.4.11 Severity:…

Information Disclosure via DBAL Restriction Handling

Component Type: TYPO3 CMS Subcomponent: DBAL (ext:core) Release Date: May 20, 2025 Vulnerability Type: Information Disclosure Affected Versions: 9.0.0-9.5.50, 10.0.0-10.4.49, 11.0.0-11.5.43,…

TYPO3 9.5.51, 10.4.50, and 11.5.44 ELTS Released

TYPO3 Association Supports an EU Sovereign Tech Fund

The letter , signed by the TYPO3 Association ’s President, Olivier Dobberkau , was based on a template formulated by OpenForum Europe , an independent open-source think tank based in Brussels,…

T3CON24 Recap – Hourly vs. Value-Based Pricing for Agencies

TYPO3 13.4.11 and 12.4.30 maintenance releases published

The following TYPO3 updates have been released: TYPO3 13.4.11 LTS TYPO3 12.4.30 LTS Both versions fix regressions introduced with TYPO3 v12.4.29 LTS and TYPO3 v13.4.10 LTS, related to open_basedir,…

TYPO3 13.4.10 and 12.4.29 maintenance releases published

The following TYPO3 updates have been released: TYPO3 13.4.10 LTS TYPO3 12.4.29 LTS Both versions are maintenance releases only. Further upgrade instructions No further database upgrades are required…

TYPO3 as a Digital Public Good: An Interview with Mathias Bolt Lesniak

Budget Idea Report: One-Click TYPO3 Playground

The TYPO3 Community Budget Ideas initiative selected the project One-Click TYPO3 Playground for Q1/2025. This solution lowers the barrier to entry for new users, simplifies contributor onboarding, and…

Why Accessibility Is No Longer an Option – But an Obligation

TYPO3 Recognized as a Digital Public Good, Reflecting its Commitment to Open Source Values