TYPO3 9 Release Notes

TYPO3 v9 LTS Release Notes Site Handling Introduced in version 9.2 The most notable new feature in TYPO3 version 9.2 is the Site Handling functionality. Already introduced in version 9.1, the Site Management module in the backend of TYPO3 now…

Sensitive links in search results of TYPO3 extension indexed_search

Component Type: TYPO3 CMS Subcomponent: Indexed Search (ext:indexed_search) Release Date: July 20, 2021 Impact: Information Disclosure Type: Advisory Problem Description On TYPO3 websites where the…

Privilege Escalation in TYPO3 Neos

Component Type: TYPO3 Neos Release Date: March 28, 2015 Bulletin Update: none Vulnerability Type: Authentication Bypass Affected Versions: 1.1.0 to 1.1.2 and 1.2.0 to 1.2.2 Severity: Low Suggested…

Sponsor a TYPO3 Code Sprint

What is a code sprint? A code sprint is made up of hard work and dedication for the TYPO3 project. Whether it is for TYPO3 CMS or for TYPO3 Neos or for that matter for any topic related to supporting…

This is the End - for TYPO3 v7 LTS

In November 2015, the TYPO3 community released TYPO3 v7 LTS - a groundbreaking version with an endless list of improvements, that brought TYPO3 CMS back on track in the CMS market. A few highlights:…

TYPO3 conference survey

This year was packed with TYPO3 events. We had an unprecendented number of codesprints and TYPO3camps. As usual there are the official TYPO3 events like the Snowboard Tour, the TYPO3 conference and…

New maintenance policy

Today the TYPO3 Core Team published its new maintenance policy on typo3.org (see link below). This translates into a nice new version matrix (thanks to Oliver Klee) that shows at a glance what is the…

T3CON10 Call for Papers

We are inviting contributions on all aspects of the TYPO3 system. The program will cover a variety of subjects including: Design, Internal System Development, Tools, and Applications. Any topic likely…

Several Vulnerabilities in extension Formhandler (formhandler)

Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 0.9.14 and below Vulnerability Types: SQL Injection, Cross-Site…

SQL Injection vulnerability in extension Formhandler (formhandler)

Release Date: September 25, 2013 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Version: 1.6.1 and alll versions below Vulnerability…

SQL Injection vulnerability in extension RealURL: speaking paths for TYPO3 (realurl)

Release Date: September 25, 2013 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.12.6 and below Vulnerability Type:…

February's diary of the TYPO3 Association

2 February: Strategy Workshop in Frankfurt On February 2nd members of the Board and of the Expert Advisory Board (EAB) of the TYPO3 Association (T3A) met in Frankfurt for a strategy workshop. The aim…

Security Bulletin TYPO3-20080619-1: Several vulnerabilities have been found in TYPO3 third party extensions

This Collective Security Bulletin (CSB) is a listing of vulnerable extensions with neither significant download numbers nor other special importance amongst the TYPO3 Community. The intention of CSBs…

Cross-Site Scripting in extension "Fluid Components" (fluid_components)

Release Date: March 22, 2023 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Component: "Fluid Components" (fluid_components) Composer Package…

Information disclosure vulnerabilities in extension "Front End User Registration" (sr_feuser_register)

Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 2.6.1 and below Vulnerability Type: Information disclosure Severity:…

Video Commune (vcommune)

Video Commune doesnt store video files, the idea is to share on-line videos links of the main famous providers youtube,,.. .The extension is being developed with the MVC framework,lib 0.0.24 and extjs…

Show extension details Download ZIP of version 0.0.3 Extension documentation

WebRTC SIP Phone (webrtc_phone)

WebRTC implementation on the Typo3 page, so that web visitor can call directly using web browser. Needs a SIP server with SIP over WebSocket capability such as OverSIP, Kamaililio, Asterisk OfficeSIP…

Show extension details Download ZIP of version 0.0.1 Extension documentation

Several Vulnerabilities in extension SmoothGallery for TYPO3 (rgsmoothgallery)

Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.5.1 and below Vulnerability Types: Cross-Site Scripting, Information…

Several Vulnerabilities in extension Direct Mail Subscription (direct_mail_subscription)

Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: Version 1.1.0 and below Vulnerability Types: SQL Injection, Cross-Site…

Calling All TYPO3 Enthusiasts: Share Your Sales Experiences!

The need for official sales enablement materials for TYPO3 have been raised multiple times. With a Marketing Team bigger and better staffed than ever before, we want to tackle this topic and create…

Vulnerabilitiy in extension Frontend User Registration (sr_feuser_register)

Component Type: Third party extension. This extensions is not part of the TYPO3 default installation. Affected Versions: Version 2.5.24 and all versions below. Vulnerability Type: Cross Site Scripting…

Codesprint: Waalwijk and Venlo Camp make for a great week in april

Our dutch friends are good for an outstanding contributing experience in April: they offer a sprint- and camp combination. MaxServ will host the TYPO3 codesprint 18.4 - 21.4 in Waalwijk, where the…

Security Bulletin TYPO3-20061010-1: fe_adminLib.inc

Affected Versions: ALL Vulnerability Type: cross Site Scripting (XSS) Severity: minor Problem Description: The "backURL" parameter is not escaped correctly. A prepared URL could potentially contain…

TYPO3 v10 Release Material

TYPO3 v10 Release Material Use these resources to boost TYPO3 v10 LTS adoption. The release of TYPO3 v10 on 21 April 2020 will be a milestone in the history of our open source CMS—23 years after it was founded in 1997. A major release is a chance to…

Captcha Bypass in extension "powermail" (powermail)

Release Date: April 10, 2014 Bulletin update: September 18, 2014 (added CVE) Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions:…