- Release Date: April 26, 2022
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: "Adminer" (t3adminer)
- Vulnerability Type: Server-side request forgery and Cross-Site Scripting
- Affected Versions: 9.6.0 and below
- Severity: Medium
- Suggested CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:X
- References: CVE-2021-29625 and CVE-2018-7667
The extension bundles a vulnerable version of the 3rd party component “adminer” which is known to be vulnerable against Server-side request forgery and Cross-Site Scripting.
An updated version 9.6.1 is available from the TYPO3 extension manager, packagist and at
Users of the extension are advised to update the extension as soon as possible.
Note: In general the TYPO3 Security Team recommends to not use any extension that bundles database or file management tools on production TYPO3 websites.
Thanks to Jigal van Hemert for providing an updated version of the extension.