Report from the Board QSA—April 2020

Although the Board meets online every two weeks throughout the year, it is necessary with longer physical meetings for in-depth and strategic discussions. These two-day meetings (called QSAs) happen…

Insecure Deserialization in Backend User Settings

Component Type: TYPO3 CMS Subcomponent: Backend User Interface (ext:backend) Release Date: May 12, 2020 Vulnerability Type: Insecure Deserialization Affected Versions: 9.0.0-9.5.16, 10.0.0-10.4.1…

Cross-Site Scripting in "SVG Sanitizer" (svg_sanitizer)

Release Date: May 12, 2020 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: SVG Sanitizer (ext:svg_sanitizer) Vulnerability Type:…

Cross-Site Scripting in Link Handling

Component Type: TYPO3 CMS Subcomponent: Link Handling (ext:frontend) Release Date: May 12, 2020 Vulnerability Type: Information Disclosure Affected Versions: 9.5.12-9.5.16, 10.2.0-10.4.1 Severity:…

Sensitive Data Exposure in extension "Job Fair" (jobfair)

Release Date: May 12, 2020 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: Job Fair (ext:jobfair) Vulnerability Type: Sensitive Data…

Cross-Site Scripting in Form Engine

Component Type: TYPO3 CMS Subcomponent: Form Engine (ext:backend) Release Date: May 12, 2020 Vulnerability Type: Cross-Site Scripting Affected Versions: 9.0.0-9.5.16, 10.0.0-10.4.1 Severity: Medium…

Broken Access Control in extension "gForum" (g_forum)

Release Date: May 12, 2020 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: gForum (ext:g_forum) Vulnerability Type: Broken Access…

Information Disclosure in Password Reset

Component Type: TYPO3 CMS Subcomponent: Password Reset (ext:backend) Release Date: May 12, 2020 Vulnerability Type: Information Disclosure Affected Versions: 10.4.0-10.4.1 Severity: Low Suggested…

Multiple vulnerabilities in extension "Direct Mail" (direct_mail)

Release Date: May 12, 2020 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: Direct Mail (ext:direct_mail) Vulnerability Type: Denial of…

TYPO3 10.4.2 and 9.5.17 security releases published

The following TYPO3 updates have been released: TYPO3 10.4.2 LTS TYPO3 9.5.17 LTS Both versions are security releases and contain important security fixes - read the corresponding Security Advisories…

SQL Injection in extension "phpMyAdmin" (phpmyadmin)

Release Date: May 12, 2020 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: phpMyAdmin (ext:phpmyadmin) Vulnerability Type: SQL…

CMS-Learning Curriculum for Educators and Students

Helping Students Learn About Content Management Learning has moved online in response to the recent COVID-19 crisis. This increases demand on educators and students to establish a workflow for online…

TYPO3 v10 Maintenance Release Schedule

As for the regular maintenance releases we have planned the following release schedule: Planned Release Date Maintenance Version April 28th, 2020 v10.4.1 May 12th, 2020 v10.4.2 June 9th, 2020 v10.4.3…

TYPO3 10.4.1 and 9.5.16 maintenance releases published

The following TYPO3 updates have been released: TYPO3 10.4.1 LTS TYPO3 9.5.16 LTS Both versions are maintenance releases only. Further upgrade instructions No database upgrades are required for these…

TYPO3 v10 LTS Press Release in 12 Languages

TYPO3 v10 LTS — Safe and Sound

After publishing five sprint releases since July 2019, we can proudly claim that we have equipped TYPO3 with the top modern PHP libraries and that we have introduced some fantastic new enterprise…

This Month in TYPO3 - March 2020 - Issue #15

Structured Content Initiative - What Happened in March?

The Structured Content Initiative is the core Strategic Initiative focused on improving the content editing user experience in TYPO3 CMS. Read our last update to learn more about what we’ve been…

Results of the Core development merger applications in 2020

Every year, we're heading for a new round of people responsible for merging code into TYPO3 Core's code basis. Today, I’m proud to announce the people behind future Core development: Component Mergers…

Vote now for the Board and the BCC of the TYPO3 Association

Every year, half of the staff of the TYPO3 Association Board and Business Control Committee (BCC) are up for reelection. This ensures that operations run smoothly at all times. The Board of the TYPO3…

TYPO3 9.5.15 and 8.7.32 maintenance releases published

The following TYPO3 updates have been released: TYPO3 9.5.15 LTS TYPO3 8.7.32 LTS Both versions are maintenance releases only. With a huge effort and activity of hundreds of contributors, more than…

TYPO3 Accessibility Initiative Needs Your Feedback

Fill in the Survey We provide information on accessibility and give the opportunity to discuss accessibility topics on a regular basis in our Slack channel #cig-accessibility and the monthly TYPO3…

Server Team Status Report—March 2020

From March 13–15, 2020, the TYPO3 Server Team organized a combined team sprint for their quarterly real-life meeting at the office of Ops One in Zürich, Switzerland. We take this opportunity to report…

Status Update: the TYPO3 Guidebook

Visit the TYPO3 Book website to find out how you can get in touch. We’ve Booked Our Publisher: Apress! Apress is a great fit for the first book about TYPO3 CMS in English in a long while. Our book…

Advice: Physical TYPO3 Association Meetings Are Possible Again

This page will be kept up-to-date with the current status of the Board’s advice. Feel free to return here to see the current status. Last updated: 14 February 2022, 14:30 CET Intended Audience This…