Vulnerability-Lookup

WID-SEC-W-2026-1585

Vulnerability from csaf_certbund - Published: 2026-05-18 22:00 - Updated: 2026-05-19 22:00

Summary

TYPO3 Extensions: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Angriff: Ein Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Betroffene Betriebssysteme: - Linux - UNIX - Windows

CVE-2026-46721

Affected products

Known affected 18 products

Product	Identifier	Version	Remediation
TYPO3 Extension ke_search <5.6.2 TYPO3 / Extension		ke_search <5.6.2
TYPO3 Extension ke_search <6.6.1 TYPO3 / Extension		ke_search <6.6.1
TYPO3 Extension tt_address <8.1.2 TYPO3 / Extension		tt_address <8.1.2
TYPO3 Extension crawler <11.0.13 TYPO3 / Extension		crawler <11.0.13
TYPO3 Extension tt_address <9.1.1 TYPO3 / Extension		tt_address <9.1.1
TYPO3 Extension crawler <12.0.11 TYPO3 / Extension		crawler <12.0.11
TYPO3 Extension tt_address <10.0.1 TYPO3 / Extension		tt_address <10.0.1
TYPO3 Extension sf_register <13.2.4 TYPO3 / Extension		sf_register <13.2.4
TYPO3 Extension ceselector <3.0.3 TYPO3 / Extension		ceselector <3.0.3
TYPO3 Extension sf_register <14.0.2 TYPO3 / Extension		sf_register <14.0.2
TYPO3 Extension ceselector <4.0.2 TYPO3 / Extension		ceselector <4.0.2
TYPO3 Extension news <11.4.4 TYPO3 / Extension		news <11.4.4
TYPO3 Extension news <12.3.2 TYPO3 / Extension		news <12.3.2
TYPO3 Extension ceselector <5.0.1 TYPO3 / Extension		ceselector <5.0.1
TYPO3 Extension news <13.0.2 TYPO3 / Extension		news <13.0.2
TYPO3 Extension ceselector <6.0.1 TYPO3 / Extension		ceselector <6.0.1
TYPO3 Extension news <14.0.3 TYPO3 / Extension		news <14.0.3
TYPO3 Extension ke_search <7.0.1 TYPO3 / Extension		ke_search <7.0.1

CVE-2026-46722

Affected products

Known affected 18 products

Product	Identifier	Version	Remediation
TYPO3 Extension ke_search <5.6.2 TYPO3 / Extension		ke_search <5.6.2
TYPO3 Extension ke_search <6.6.1 TYPO3 / Extension		ke_search <6.6.1
TYPO3 Extension tt_address <8.1.2 TYPO3 / Extension		tt_address <8.1.2
TYPO3 Extension crawler <11.0.13 TYPO3 / Extension		crawler <11.0.13
TYPO3 Extension tt_address <9.1.1 TYPO3 / Extension		tt_address <9.1.1
TYPO3 Extension crawler <12.0.11 TYPO3 / Extension		crawler <12.0.11
TYPO3 Extension tt_address <10.0.1 TYPO3 / Extension		tt_address <10.0.1
TYPO3 Extension sf_register <13.2.4 TYPO3 / Extension		sf_register <13.2.4
TYPO3 Extension ceselector <3.0.3 TYPO3 / Extension		ceselector <3.0.3
TYPO3 Extension sf_register <14.0.2 TYPO3 / Extension		sf_register <14.0.2
TYPO3 Extension ceselector <4.0.2 TYPO3 / Extension		ceselector <4.0.2
TYPO3 Extension news <11.4.4 TYPO3 / Extension		news <11.4.4
TYPO3 Extension news <12.3.2 TYPO3 / Extension		news <12.3.2
TYPO3 Extension ceselector <5.0.1 TYPO3 / Extension		ceselector <5.0.1
TYPO3 Extension news <13.0.2 TYPO3 / Extension		news <13.0.2
TYPO3 Extension ceselector <6.0.1 TYPO3 / Extension		ceselector <6.0.1
TYPO3 Extension news <14.0.3 TYPO3 / Extension		news <14.0.3
TYPO3 Extension ke_search <7.0.1 TYPO3 / Extension		ke_search <7.0.1

CVE-2026-46723

Affected products

Known affected 18 products

Product	Identifier	Version	Remediation
TYPO3 Extension ke_search <5.6.2 TYPO3 / Extension		ke_search <5.6.2
TYPO3 Extension ke_search <6.6.1 TYPO3 / Extension		ke_search <6.6.1
TYPO3 Extension tt_address <8.1.2 TYPO3 / Extension		tt_address <8.1.2
TYPO3 Extension crawler <11.0.13 TYPO3 / Extension		crawler <11.0.13
TYPO3 Extension tt_address <9.1.1 TYPO3 / Extension		tt_address <9.1.1
TYPO3 Extension crawler <12.0.11 TYPO3 / Extension		crawler <12.0.11
TYPO3 Extension tt_address <10.0.1 TYPO3 / Extension		tt_address <10.0.1
TYPO3 Extension sf_register <13.2.4 TYPO3 / Extension		sf_register <13.2.4
TYPO3 Extension ceselector <3.0.3 TYPO3 / Extension		ceselector <3.0.3
TYPO3 Extension sf_register <14.0.2 TYPO3 / Extension		sf_register <14.0.2
TYPO3 Extension ceselector <4.0.2 TYPO3 / Extension		ceselector <4.0.2
TYPO3 Extension news <11.4.4 TYPO3 / Extension		news <11.4.4
TYPO3 Extension news <12.3.2 TYPO3 / Extension		news <12.3.2
TYPO3 Extension ceselector <5.0.1 TYPO3 / Extension		ceselector <5.0.1
TYPO3 Extension news <13.0.2 TYPO3 / Extension		news <13.0.2
TYPO3 Extension ceselector <6.0.1 TYPO3 / Extension		ceselector <6.0.1
TYPO3 Extension news <14.0.3 TYPO3 / Extension		news <14.0.3
TYPO3 Extension ke_search <7.0.1 TYPO3 / Extension		ke_search <7.0.1

CVE-2026-46724

Affected products

Known affected 18 products

Product	Identifier	Version	Remediation
TYPO3 Extension ke_search <5.6.2 TYPO3 / Extension		ke_search <5.6.2
TYPO3 Extension ke_search <6.6.1 TYPO3 / Extension		ke_search <6.6.1
TYPO3 Extension tt_address <8.1.2 TYPO3 / Extension		tt_address <8.1.2
TYPO3 Extension crawler <11.0.13 TYPO3 / Extension		crawler <11.0.13
TYPO3 Extension tt_address <9.1.1 TYPO3 / Extension		tt_address <9.1.1
TYPO3 Extension crawler <12.0.11 TYPO3 / Extension		crawler <12.0.11
TYPO3 Extension tt_address <10.0.1 TYPO3 / Extension		tt_address <10.0.1
TYPO3 Extension sf_register <13.2.4 TYPO3 / Extension		sf_register <13.2.4
TYPO3 Extension ceselector <3.0.3 TYPO3 / Extension		ceselector <3.0.3
TYPO3 Extension sf_register <14.0.2 TYPO3 / Extension		sf_register <14.0.2
TYPO3 Extension ceselector <4.0.2 TYPO3 / Extension		ceselector <4.0.2
TYPO3 Extension news <11.4.4 TYPO3 / Extension		news <11.4.4
TYPO3 Extension news <12.3.2 TYPO3 / Extension		news <12.3.2
TYPO3 Extension ceselector <5.0.1 TYPO3 / Extension		ceselector <5.0.1
TYPO3 Extension news <13.0.2 TYPO3 / Extension		news <13.0.2
TYPO3 Extension ceselector <6.0.1 TYPO3 / Extension		ceselector <6.0.1
TYPO3 Extension news <14.0.3 TYPO3 / Extension		news <14.0.3
TYPO3 Extension ke_search <7.0.1 TYPO3 / Extension		ke_search <7.0.1

CVE-2026-46725

Affected products

Known affected 18 products

Product	Identifier	Version	Remediation
TYPO3 Extension ke_search <5.6.2 TYPO3 / Extension		ke_search <5.6.2
TYPO3 Extension ke_search <6.6.1 TYPO3 / Extension		ke_search <6.6.1
TYPO3 Extension tt_address <8.1.2 TYPO3 / Extension		tt_address <8.1.2
TYPO3 Extension crawler <11.0.13 TYPO3 / Extension		crawler <11.0.13
TYPO3 Extension tt_address <9.1.1 TYPO3 / Extension		tt_address <9.1.1
TYPO3 Extension crawler <12.0.11 TYPO3 / Extension		crawler <12.0.11
TYPO3 Extension tt_address <10.0.1 TYPO3 / Extension		tt_address <10.0.1
TYPO3 Extension sf_register <13.2.4 TYPO3 / Extension		sf_register <13.2.4
TYPO3 Extension ceselector <3.0.3 TYPO3 / Extension		ceselector <3.0.3
TYPO3 Extension sf_register <14.0.2 TYPO3 / Extension		sf_register <14.0.2
TYPO3 Extension ceselector <4.0.2 TYPO3 / Extension		ceselector <4.0.2
TYPO3 Extension news <11.4.4 TYPO3 / Extension		news <11.4.4
TYPO3 Extension news <12.3.2 TYPO3 / Extension		news <12.3.2
TYPO3 Extension ceselector <5.0.1 TYPO3 / Extension		ceselector <5.0.1
TYPO3 Extension news <13.0.2 TYPO3 / Extension		news <13.0.2
TYPO3 Extension ceselector <6.0.1 TYPO3 / Extension		ceselector <6.0.1
TYPO3 Extension news <14.0.3 TYPO3 / Extension		news <14.0.3
TYPO3 Extension ke_search <7.0.1 TYPO3 / Extension		ke_search <7.0.1

CVE-2026-8726

Affected products

Known affected 18 products

Product	Identifier	Version	Remediation
TYPO3 Extension ke_search <5.6.2 TYPO3 / Extension		ke_search <5.6.2
TYPO3 Extension ke_search <6.6.1 TYPO3 / Extension		ke_search <6.6.1
TYPO3 Extension tt_address <8.1.2 TYPO3 / Extension		tt_address <8.1.2
TYPO3 Extension crawler <11.0.13 TYPO3 / Extension		crawler <11.0.13
TYPO3 Extension tt_address <9.1.1 TYPO3 / Extension		tt_address <9.1.1
TYPO3 Extension crawler <12.0.11 TYPO3 / Extension		crawler <12.0.11
TYPO3 Extension tt_address <10.0.1 TYPO3 / Extension		tt_address <10.0.1
TYPO3 Extension sf_register <13.2.4 TYPO3 / Extension		sf_register <13.2.4
TYPO3 Extension ceselector <3.0.3 TYPO3 / Extension		ceselector <3.0.3
TYPO3 Extension sf_register <14.0.2 TYPO3 / Extension		sf_register <14.0.2
TYPO3 Extension ceselector <4.0.2 TYPO3 / Extension		ceselector <4.0.2
TYPO3 Extension news <11.4.4 TYPO3 / Extension		news <11.4.4
TYPO3 Extension news <12.3.2 TYPO3 / Extension		news <12.3.2
TYPO3 Extension ceselector <5.0.1 TYPO3 / Extension		ceselector <5.0.1
TYPO3 Extension news <13.0.2 TYPO3 / Extension		news <13.0.2
TYPO3 Extension ceselector <6.0.1 TYPO3 / Extension		ceselector <6.0.1
TYPO3 Extension news <14.0.3 TYPO3 / Extension		news <14.0.3
TYPO3 Extension ke_search <7.0.1 TYPO3 / Extension		ke_search <7.0.1

CVE-2026-8727

Affected products

Known affected 18 products

Product	Identifier	Version	Remediation
TYPO3 Extension ke_search <5.6.2 TYPO3 / Extension		ke_search <5.6.2
TYPO3 Extension ke_search <6.6.1 TYPO3 / Extension		ke_search <6.6.1
TYPO3 Extension tt_address <8.1.2 TYPO3 / Extension		tt_address <8.1.2
TYPO3 Extension crawler <11.0.13 TYPO3 / Extension		crawler <11.0.13
TYPO3 Extension tt_address <9.1.1 TYPO3 / Extension		tt_address <9.1.1
TYPO3 Extension crawler <12.0.11 TYPO3 / Extension		crawler <12.0.11
TYPO3 Extension tt_address <10.0.1 TYPO3 / Extension		tt_address <10.0.1
TYPO3 Extension sf_register <13.2.4 TYPO3 / Extension		sf_register <13.2.4
TYPO3 Extension ceselector <3.0.3 TYPO3 / Extension		ceselector <3.0.3
TYPO3 Extension sf_register <14.0.2 TYPO3 / Extension		sf_register <14.0.2
TYPO3 Extension ceselector <4.0.2 TYPO3 / Extension		ceselector <4.0.2
TYPO3 Extension news <11.4.4 TYPO3 / Extension		news <11.4.4
TYPO3 Extension news <12.3.2 TYPO3 / Extension		news <12.3.2
TYPO3 Extension ceselector <5.0.1 TYPO3 / Extension		ceselector <5.0.1
TYPO3 Extension news <13.0.2 TYPO3 / Extension		news <13.0.2
TYPO3 Extension ceselector <6.0.1 TYPO3 / Extension		ceselector <6.0.1
TYPO3 Extension news <14.0.3 TYPO3 / Extension		news <14.0.3
TYPO3 Extension ke_search <7.0.1 TYPO3 / Extension		ke_search <7.0.1

CVE-2026-8827

Affected products

Known affected 18 products

Product	Identifier	Version	Remediation
TYPO3 Extension ke_search <5.6.2 TYPO3 / Extension		ke_search <5.6.2
TYPO3 Extension ke_search <6.6.1 TYPO3 / Extension		ke_search <6.6.1
TYPO3 Extension tt_address <8.1.2 TYPO3 / Extension		tt_address <8.1.2
TYPO3 Extension crawler <11.0.13 TYPO3 / Extension		crawler <11.0.13
TYPO3 Extension tt_address <9.1.1 TYPO3 / Extension		tt_address <9.1.1
TYPO3 Extension crawler <12.0.11 TYPO3 / Extension		crawler <12.0.11
TYPO3 Extension tt_address <10.0.1 TYPO3 / Extension		tt_address <10.0.1
TYPO3 Extension sf_register <13.2.4 TYPO3 / Extension		sf_register <13.2.4
TYPO3 Extension ceselector <3.0.3 TYPO3 / Extension		ceselector <3.0.3
TYPO3 Extension sf_register <14.0.2 TYPO3 / Extension		sf_register <14.0.2
TYPO3 Extension ceselector <4.0.2 TYPO3 / Extension		ceselector <4.0.2
TYPO3 Extension news <11.4.4 TYPO3 / Extension		news <11.4.4
TYPO3 Extension news <12.3.2 TYPO3 / Extension		news <12.3.2
TYPO3 Extension ceselector <5.0.1 TYPO3 / Extension		ceselector <5.0.1
TYPO3 Extension news <13.0.2 TYPO3 / Extension		news <13.0.2
TYPO3 Extension ceselector <6.0.1 TYPO3 / Extension		ceselector <6.0.1
TYPO3 Extension news <14.0.3 TYPO3 / Extension		news <14.0.3
TYPO3 Extension ke_search <7.0.1 TYPO3 / Extension		ke_search <7.0.1

References

8 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://typo3.org/security/advisory/typo3-ext-sa-…	external
https://typo3.org/security/advisory/typo3-ext-sa-…	external
https://typo3.org/security/advisory/typo3-ext-sa-…	external
https://typo3.org/security/advisory/typo3-ext-sa-…	external
https://typo3.org/security/advisory/typo3-ext-sa-…	external
https://typo3.org/security/advisory/typo3-ext-sa-…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. \u00dcber zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuf\u00fchren, um einen SQL-Injection Angriff durchzuf\u00fchren, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2026-1585 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-1585.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2026-1585 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-1585"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-05-18",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-008"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-05-18",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-009"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-05-18",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-010"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-05-18",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-011"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-05-18",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-012"
      },
      {
        "category": "external",
        "summary": "Typo3 Security Advisory vom 2026-05-18",
        "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-013"
      }
    ],
    "source_lang": "en-US",
    "title": "TYPO3 Extensions: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-05-19T22:00:00.000+00:00",
      "generator": {
        "date": "2026-05-20T07:21:07.389+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.6.0"
        }
      },
      "id": "WID-SEC-W-2026-1585",
      "initial_release_date": "2026-05-18T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2026-05-18T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2026-05-19T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2026-30865, EUVD-2026-30866, EUVD-2026-30864, EUVD-2026-30863, EUVD-2026-30859, EUVD-2026-30861, EUVD-2026-30857, EUVD-2026-30854"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "ceselector \u003c6.0.1",
                "product": {
                  "name": "TYPO3 Extension ceselector \u003c6.0.1",
                  "product_id": "T054311"
                }
              },
              {
                "category": "product_version",
                "name": "ceselector 6.0.1",
                "product": {
                  "name": "TYPO3 Extension ceselector 6.0.1",
                  "product_id": "T054311-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:ceselector__6.0.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ceselector \u003c5.0.1",
                "product": {
                  "name": "TYPO3 Extension ceselector \u003c5.0.1",
                  "product_id": "T054312"
                }
              },
              {
                "category": "product_version",
                "name": "ceselector 5.0.1",
                "product": {
                  "name": "TYPO3 Extension ceselector 5.0.1",
                  "product_id": "T054312-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:ceselector__5.0.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ceselector \u003c4.0.2",
                "product": {
                  "name": "TYPO3 Extension ceselector \u003c4.0.2",
                  "product_id": "T054314"
                }
              },
              {
                "category": "product_version",
                "name": "ceselector 4.0.2",
                "product": {
                  "name": "TYPO3 Extension ceselector 4.0.2",
                  "product_id": "T054314-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:ceselector__4.0.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ceselector \u003c3.0.3",
                "product": {
                  "name": "TYPO3 Extension ceselector \u003c3.0.3",
                  "product_id": "T054315"
                }
              },
              {
                "category": "product_version",
                "name": "ceselector 3.0.3",
                "product": {
                  "name": "TYPO3 Extension ceselector 3.0.3",
                  "product_id": "T054315-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:ceselector__3.0.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "tt_address \u003c10.0.1",
                "product": {
                  "name": "TYPO3 Extension tt_address \u003c10.0.1",
                  "product_id": "T054316"
                }
              },
              {
                "category": "product_version",
                "name": "tt_address 10.0.1",
                "product": {
                  "name": "TYPO3 Extension tt_address 10.0.1",
                  "product_id": "T054316-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:tt_address__10.0.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "tt_address \u003c9.1.1",
                "product": {
                  "name": "TYPO3 Extension tt_address \u003c9.1.1",
                  "product_id": "T054317"
                }
              },
              {
                "category": "product_version",
                "name": "tt_address 9.1.1",
                "product": {
                  "name": "TYPO3 Extension tt_address 9.1.1",
                  "product_id": "T054317-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:tt_address__9.1.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "tt_address \u003c8.1.2",
                "product": {
                  "name": "TYPO3 Extension tt_address \u003c8.1.2",
                  "product_id": "T054318"
                }
              },
              {
                "category": "product_version",
                "name": "tt_address 8.1.2",
                "product": {
                  "name": "TYPO3 Extension tt_address 8.1.2",
                  "product_id": "T054318-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:tt_address__8.1.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ke_search \u003c7.0.1",
                "product": {
                  "name": "TYPO3 Extension ke_search \u003c7.0.1",
                  "product_id": "T054319"
                }
              },
              {
                "category": "product_version",
                "name": "ke_search 7.0.1",
                "product": {
                  "name": "TYPO3 Extension ke_search 7.0.1",
                  "product_id": "T054319-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:ke_search__7.0.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ke_search \u003c6.6.1",
                "product": {
                  "name": "TYPO3 Extension ke_search \u003c6.6.1",
                  "product_id": "T054320"
                }
              },
              {
                "category": "product_version",
                "name": "ke_search 6.6.1",
                "product": {
                  "name": "TYPO3 Extension ke_search 6.6.1",
                  "product_id": "T054320-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:ke_search__6.6.1"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "ke_search \u003c5.6.2",
                "product": {
                  "name": "TYPO3 Extension ke_search \u003c5.6.2",
                  "product_id": "T054321"
                }
              },
              {
                "category": "product_version",
                "name": "ke_search 5.6.2",
                "product": {
                  "name": "TYPO3 Extension ke_search 5.6.2",
                  "product_id": "T054321-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:ke_search__5.6.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "news \u003c14.0.3",
                "product": {
                  "name": "TYPO3 Extension news \u003c14.0.3",
                  "product_id": "T054322"
                }
              },
              {
                "category": "product_version",
                "name": "news 14.0.3",
                "product": {
                  "name": "TYPO3 Extension news 14.0.3",
                  "product_id": "T054322-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:news__14.0.3"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "news \u003c13.0.2",
                "product": {
                  "name": "TYPO3 Extension news \u003c13.0.2",
                  "product_id": "T054323"
                }
              },
              {
                "category": "product_version",
                "name": "news 13.0.2",
                "product": {
                  "name": "TYPO3 Extension news 13.0.2",
                  "product_id": "T054323-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:news__13.0.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "news \u003c12.3.2",
                "product": {
                  "name": "TYPO3 Extension news \u003c12.3.2",
                  "product_id": "T054324"
                }
              },
              {
                "category": "product_version",
                "name": "news 12.3.2",
                "product": {
                  "name": "TYPO3 Extension news 12.3.2",
                  "product_id": "T054324-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:news__12.3.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "news \u003c11.4.4",
                "product": {
                  "name": "TYPO3 Extension news \u003c11.4.4",
                  "product_id": "T054325"
                }
              },
              {
                "category": "product_version",
                "name": "news 11.4.4",
                "product": {
                  "name": "TYPO3 Extension news 11.4.4",
                  "product_id": "T054325-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:news__11.4.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "sf_register \u003c14.0.2",
                "product": {
                  "name": "TYPO3 Extension sf_register \u003c14.0.2",
                  "product_id": "T054326"
                }
              },
              {
                "category": "product_version",
                "name": "sf_register 14.0.2",
                "product": {
                  "name": "TYPO3 Extension sf_register 14.0.2",
                  "product_id": "T054326-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:sf_register__14.0.2"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "sf_register \u003c13.2.4",
                "product": {
                  "name": "TYPO3 Extension sf_register \u003c13.2.4",
                  "product_id": "T054327"
                }
              },
              {
                "category": "product_version",
                "name": "sf_register 13.2.4",
                "product": {
                  "name": "TYPO3 Extension sf_register 13.2.4",
                  "product_id": "T054327-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:sf_register__13.2.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "crawler \u003c12.0.11",
                "product": {
                  "name": "TYPO3 Extension crawler \u003c12.0.11",
                  "product_id": "T054328"
                }
              },
              {
                "category": "product_version",
                "name": "crawler 12.0.11",
                "product": {
                  "name": "TYPO3 Extension crawler 12.0.11",
                  "product_id": "T054328-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:crawler__12.0.11"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "crawler \u003c11.0.13",
                "product": {
                  "name": "TYPO3 Extension crawler \u003c11.0.13",
                  "product_id": "T054329"
                }
              },
              {
                "category": "product_version",
                "name": "crawler 11.0.13",
                "product": {
                  "name": "TYPO3 Extension crawler 11.0.13",
                  "product_id": "T054329-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:typo3:typo3_extension:crawler__11.0.13"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Extension"
          }
        ],
        "category": "vendor",
        "name": "TYPO3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-46721",
      "product_status": {
        "known_affected": [
          "T054321",
          "T054320",
          "T054318",
          "T054329",
          "T054317",
          "T054328",
          "T054316",
          "T054327",
          "T054315",
          "T054326",
          "T054314",
          "T054325",
          "T054324",
          "T054312",
          "T054323",
          "T054311",
          "T054322",
          "T054319"
        ]
      },
      "release_date": "2026-05-18T22:00:00.000+00:00",
      "title": "CVE-2026-46721"
    },
    {
      "cve": "CVE-2026-46722",
      "product_status": {
        "known_affected": [
          "T054321",
          "T054320",
          "T054318",
          "T054329",
          "T054317",
          "T054328",
          "T054316",
          "T054327",
          "T054315",
          "T054326",
          "T054314",
          "T054325",
          "T054324",
          "T054312",
          "T054323",
          "T054311",
          "T054322",
          "T054319"
        ]
      },
      "release_date": "2026-05-18T22:00:00.000+00:00",
      "title": "CVE-2026-46722"
    },
    {
      "cve": "CVE-2026-46723",
      "product_status": {
        "known_affected": [
          "T054321",
          "T054320",
          "T054318",
          "T054329",
          "T054317",
          "T054328",
          "T054316",
          "T054327",
          "T054315",
          "T054326",
          "T054314",
          "T054325",
          "T054324",
          "T054312",
          "T054323",
          "T054311",
          "T054322",
          "T054319"
        ]
      },
      "release_date": "2026-05-18T22:00:00.000+00:00",
      "title": "CVE-2026-46723"
    },
    {
      "cve": "CVE-2026-46724",
      "product_status": {
        "known_affected": [
          "T054321",
          "T054320",
          "T054318",
          "T054329",
          "T054317",
          "T054328",
          "T054316",
          "T054327",
          "T054315",
          "T054326",
          "T054314",
          "T054325",
          "T054324",
          "T054312",
          "T054323",
          "T054311",
          "T054322",
          "T054319"
        ]
      },
      "release_date": "2026-05-18T22:00:00.000+00:00",
      "title": "CVE-2026-46724"
    },
    {
      "cve": "CVE-2026-46725",
      "product_status": {
        "known_affected": [
          "T054321",
          "T054320",
          "T054318",
          "T054329",
          "T054317",
          "T054328",
          "T054316",
          "T054327",
          "T054315",
          "T054326",
          "T054314",
          "T054325",
          "T054324",
          "T054312",
          "T054323",
          "T054311",
          "T054322",
          "T054319"
        ]
      },
      "release_date": "2026-05-18T22:00:00.000+00:00",
      "title": "CVE-2026-46725"
    },
    {
      "cve": "CVE-2026-8726",
      "product_status": {
        "known_affected": [
          "T054321",
          "T054320",
          "T054318",
          "T054329",
          "T054317",
          "T054328",
          "T054316",
          "T054327",
          "T054315",
          "T054326",
          "T054314",
          "T054325",
          "T054324",
          "T054312",
          "T054323",
          "T054311",
          "T054322",
          "T054319"
        ]
      },
      "release_date": "2026-05-18T22:00:00.000+00:00",
      "title": "CVE-2026-8726"
    },
    {
      "cve": "CVE-2026-8727",
      "product_status": {
        "known_affected": [
          "T054321",
          "T054320",
          "T054318",
          "T054329",
          "T054317",
          "T054328",
          "T054316",
          "T054327",
          "T054315",
          "T054326",
          "T054314",
          "T054325",
          "T054324",
          "T054312",
          "T054323",
          "T054311",
          "T054322",
          "T054319"
        ]
      },
      "release_date": "2026-05-18T22:00:00.000+00:00",
      "title": "CVE-2026-8727"
    },
    {
      "cve": "CVE-2026-8827",
      "product_status": {
        "known_affected": [
          "T054321",
          "T054320",
          "T054318",
          "T054329",
          "T054317",
          "T054328",
          "T054316",
          "T054327",
          "T054315",
          "T054326",
          "T054314",
          "T054325",
          "T054324",
          "T054312",
          "T054323",
          "T054311",
          "T054322",
          "T054319"
        ]
      },
      "release_date": "2026-05-18T22:00:00.000+00:00",
      "title": "CVE-2026-8827"
    }
  ]
}

CVE-2026-46721 (GCVE-0-2026-46721)

Vulnerability from cvelistv5 – Published: 2026-05-19 09:19 – Updated: 2026-05-19 13:21

Title

Broken Access Control in extension "Frontend User Registration" (sf_register)

Summary

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Frontend User Registration"	Affected: 14.0.0 , < 14.0.2 (semver) Affected: 0 , < 13.2.4 (semver)

Date Public

2026-05-19 09:00

Credits

Seungbin Yang Sebastian Fischer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46721",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T13:21:27.294366Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T13:21:39.704Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "evoweb/sf-register",
          "product": "Extension \"Frontend User Registration\"",
          "repo": "https://github.com/evoWeb/sf_register",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "14.0.2",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.2.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Seungbin Yang"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Sebastian Fischer"
        }
      ],
      "datePublic": "2026-05-19T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups."
            }
          ],
          "value": "The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "LOW",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-915",
              "description": "CWE-915",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-639",
              "description": "CWE-639",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T09:19:10.688Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-009"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Broken Access Control in extension \"Frontend User Registration\" (sf_register)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-46721",
    "datePublished": "2026-05-19T09:19:10.688Z",
    "dateReserved": "2026-05-16T09:55:27.478Z",
    "dateUpdated": "2026-05-19T13:21:39.704Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46722 (GCVE-0-2026-46722)

Vulnerability from cvelistv5 – Published: 2026-05-19 09:23 – Updated: 2026-06-03 10:54

Title

XML External Entity Injection in extension "Faceted Search" (ke_search)

Summary

The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-611 - Improper Restriction of XML External Entity Reference

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Faceted Search"	Affected: 7.0.0 , < 7.0.1 (semver) Affected: 6.0.0 , < 6.6.1 (semver) Affected: 5.0.0 , < 5.6.2 (semver) Affected: 0 , < 4.6.7 (semver)

Date Public

2026-05-19 09:00

Credits

Seungbin Yang Christian Bülter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46722",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T13:29:49.636642Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T13:30:04.573Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "tpwd/ke_search",
          "product": "Extension \"Faceted Search\"",
          "repo": "https://github.com/tpwd/ke_search",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "7.0.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.1",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6.2",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "4.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Seungbin Yang"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian B\u00fclter"
        }
      ],
      "datePublic": "2026-05-19T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index."
            }
          ],
          "value": "The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being written to the search index."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-611",
              "description": "CWE-611 Improper Restriction of XML External Entity Reference",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T10:54:43.520Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-011"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "XML External Entity Injection in extension \"Faceted Search\" (ke_search)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-46722",
    "datePublished": "2026-05-19T09:23:02.618Z",
    "dateReserved": "2026-05-16T09:55:27.478Z",
    "dateUpdated": "2026-06-03T10:54:43.520Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46723 (GCVE-0-2026-46723)

Vulnerability from cvelistv5 – Published: 2026-05-19 09:23 – Updated: 2026-05-19 13:30

Title

Information Disclosure in extension "Faceted Search" (ke_search)

Summary

The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-668 - Exposure of Resource to Wrong Sphere

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Faceted Search"	Affected: 7.0.0 , < 7.0.1 (semver) Affected: 6.0.0 , < 6.6.1 (semver) Affected: 0 , < 5.6.2 (semver)

Date Public

2026-05-19 09:00

Credits

Seungbin Yang Christian Bülter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46723",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T13:30:23.388487Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T13:30:30.411Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "tpwd/ke_search",
          "product": "Extension \"Faceted Search\"",
          "repo": "https://github.com/tpwd/ke_search",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "7.0.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.1",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Seungbin Yang"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian B\u00fclter"
        }
      ],
      "datePublic": "2026-05-19T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The \u003ccode\u003eadditional_tables\u003c/code\u003e configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index."
            }
          ],
          "value": "The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668 Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T09:23:32.228Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-011"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Information Disclosure in extension \"Faceted Search\" (ke_search)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-46723",
    "datePublished": "2026-05-19T09:23:32.228Z",
    "dateReserved": "2026-05-16T09:55:27.478Z",
    "dateUpdated": "2026-05-19T13:30:30.411Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46724 (GCVE-0-2026-46724)

Vulnerability from cvelistv5 – Published: 2026-05-19 09:24 – Updated: 2026-06-03 10:57

Title

Path Traversal in extension "Faceted Search" (ke_search)

Summary

The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.

Severity

5.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Faceted Search"	Affected: 7.0.0 , < 7.0.1 (semver) Affected: 6.0.0 , < 6.6.1 (semver) Affected: 5.0.0 , < 5.6.2 (semver) Affected: 0 , < 4.6.7 (semver)

Date Public

2026-05-19 09:00

Credits

Seungbin Yang Christian Bülter

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46724",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T13:30:42.460842Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T13:30:48.475Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "tpwd/ke_search",
          "product": "Extension \"Faceted Search\"",
          "repo": "https://github.com/tpwd/ke_search",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "7.0.1",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.6.1",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.6.2",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "4.6.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Seungbin Yang"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Christian B\u00fclter"
        }
      ],
      "datePublic": "2026-05-19T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences."
            }
          ],
          "value": "The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-03T10:57:06.759Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-011"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Path Traversal in extension \"Faceted Search\" (ke_search)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-46724",
    "datePublished": "2026-05-19T09:24:04.165Z",
    "dateReserved": "2026-05-16T09:55:27.478Z",
    "dateUpdated": "2026-06-03T10:57:06.759Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-46725 (GCVE-0-2026-46725)

Vulnerability from cvelistv5 – Published: 2026-05-19 09:25 – Updated: 2026-05-19 13:29

Title

Remote Code Execution in extension "Content Element Selector" (ceselector)

Summary

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with "Persistent Mode: Static" in the plugin settings.

Severity

9.2 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Content Element Selector"	Affected: 6.0.0 , < 6.0.1 (semver) Affected: 5.0.0 , < 5.0.1 (semver) Affected: 4.0.0 , < 4.0.2 (semver) Affected: 0 , < 3.0.3 (semver)

Date Public

2026-05-19 09:00

Credits

Torben Hansen Matthias Mächler

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-46725",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T13:28:39.738439Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T13:29:29.556Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "mmc/ceselector",
          "product": "Extension \"Content Element Selector\"",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "6.0.1",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "5.0.1",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "4.0.2",
              "status": "affected",
              "version": "4.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "3.0.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Torben Hansen"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Matthias M\u00e4chler"
        }
      ],
      "datePublic": "2026-05-19T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The extension passes an attacker-controlled cookie directly to PHP\u0027s \u003ccode\u003eunserialize()\u003c/code\u003e without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with \"Persistent Mode: Static\" in the plugin settings."
            }
          ],
          "value": "The extension passes an attacker-controlled cookie directly to PHP\u0027s unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server. Exploitation requires the content element to be configured with \"Persistent Mode: Static\" in the plugin settings."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 9.2,
            "baseSeverity": "CRITICAL",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T09:25:33.489Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-013"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code Execution in extension \"Content Element Selector\" (ceselector)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-46725",
    "datePublished": "2026-05-19T09:25:33.489Z",
    "dateReserved": "2026-05-16T09:55:27.478Z",
    "dateUpdated": "2026-05-19T13:29:29.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8726 (GCVE-0-2026-8726)

Vulnerability from cvelistv5 – Published: 2026-05-19 09:22 – Updated: 2026-06-02 17:34

Title

SQL Injection in extension "News system" (news)

Summary

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "News system"	Affected: 14.0.0 , < 14.0.3 (semver) Affected: 13.0.0 , < 13.0.2 (semver) Affected: 12.0.0 , < 12.3.2 (semver) Affected: 11.0.0 , < 11.4.4 (semver) Affected: 0 , < 10.0.4 (semver)

Date Public

2026-05-19 09:00

Credits

Christian Kuhn Georg Ringer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8726",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T13:23:27.759407Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T13:23:36.360Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "georgringer/news",
          "product": "Extension \"News system\"",
          "repo": "https://github.com/georgringer/news",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "14.0.3",
              "status": "affected",
              "version": "14.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "13.0.2",
              "status": "affected",
              "version": "13.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "12.3.2",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.4.4",
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "10.0.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Christian Kuhn"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Georg Ringer"
        }
      ],
      "datePublic": "2026-05-19T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting \u003ccode\u003edisableOverrideDemand\u003c/code\u003e not to be enabled."
            }
          ],
          "value": "The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the \"Date Menu of news articles\" plugin. Exploitation requires the \"Date Menu of news articles\" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T17:34:48.804Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-010"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SQL Injection in extension \"News system\" (news)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-8726",
    "datePublished": "2026-05-19T09:22:09.037Z",
    "dateReserved": "2026-05-16T09:55:31.608Z",
    "dateUpdated": "2026-06-02T17:34:48.804Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8727 (GCVE-0-2026-8727)

Vulnerability from cvelistv5 – Published: 2026-05-19 09:16 – Updated: 2026-05-19 13:25

Title

Remote Code Execution in extension "Site Crawler" (crawler)

Summary

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task.

Severity

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Site Crawler"	Affected: 12.0.0 , < 12.0.11 (semver) Affected: 0 , < 11.0.13 (semver)

Date Public

2026-05-19 09:00

Credits

Roman Hergenreder Tomas Norre Mikkelsen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8727",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T13:25:27.312318Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T13:25:34.994Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "tomasnorre/crawler",
          "product": "Extension \"Site Crawler\"",
          "repo": "https://github.com/tomasnorre/crawler",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "12.0.11",
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.0.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Roman Hergenreder"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Tomas Norre Mikkelsen"
        }
      ],
      "datePublic": "2026-05-19T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The Crawler extension passes the \u003ccode\u003eX-T3Crawler-Meta\u003c/code\u003e response header from crawled URLs directly to PHP\u0027s \u003ccode\u003eunserialize()\u003c/code\u003e. An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task."
            }
          ],
          "value": "The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP\u0027s unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "LOW",
            "userInteraction": "ACTIVE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T09:16:33.677Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-008"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Remote Code Execution in extension \"Site Crawler\" (crawler)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-8727",
    "datePublished": "2026-05-19T09:16:33.677Z",
    "dateReserved": "2026-05-16T09:55:33.916Z",
    "dateUpdated": "2026-05-19T13:25:34.994Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-8827 (GCVE-0-2026-8827)

Vulnerability from cvelistv5 – Published: 2026-05-19 09:24 – Updated: 2026-05-19 13:31

Title

SQL Injection in extension "Address List" (tt_address)

Summary

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator (v2.0.3)

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

TYPO3

References

1 reference

URL	Tags
https://typo3.org/security/advisory/typo3-ext-sa-…	vendor-advisory

Impacted products

1 product

Vendor	Product	Version
TYPO3	Extension "Address List"	Affected: 10.0.0 , < 10.0.1 (semver) Affected: 9.0.0 , < 9.1.1 (semver) Affected: 0 , < 8.1.2 (semver)

Date Public

2026-05-19 09:00

Credits

Georg Ringer Georg Ringer

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-8827",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-19T13:31:02.792716Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-19T13:31:11.513Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://packagist.org/",
          "defaultStatus": "unaffected",
          "packageName": "friendsoftypo3/tt-address",
          "product": "Extension \"Address List\"",
          "repo": "https://github.com/FriendsOfTYPO3/tt_address",
          "vendor": "TYPO3",
          "versions": [
            {
              "lessThan": "10.0.1",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "9.1.1",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.1.2",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Georg Ringer"
        },
        {
          "lang": "en",
          "type": "remediation developer",
          "value": "Georg Ringer"
        }
      ],
      "datePublic": "2026-05-19T09:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "The \u003ccode\u003eAddressRepository::getSqlQuery()\u003c/code\u003e method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection."
            }
          ],
          "value": "The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-19T09:24:50.564Z",
        "orgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "shortName": "TYPO3"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://typo3.org/security/advisory/typo3-ext-sa-2026-012"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "SQL Injection in extension \"Address List\" (tt_address)",
      "x_generator": {
        "engine": "Vulnogram 1.0.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
    "assignerShortName": "TYPO3",
    "cveId": "CVE-2026-8827",
    "datePublished": "2026-05-19T09:24:50.564Z",
    "dateReserved": "2026-05-18T11:19:55.225Z",
    "dateUpdated": "2026-05-19T13:31:11.513Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2026-1585

CVE-2026-46721 (GCVE-0-2026-46721)

CVE-2026-46722 (GCVE-0-2026-46722)

CVE-2026-46723 (GCVE-0-2026-46723)

CVE-2026-46724 (GCVE-0-2026-46724)

CVE-2026-46725 (GCVE-0-2026-46725)

CVE-2026-8726 (GCVE-0-2026-8726)

CVE-2026-8727 (GCVE-0-2026-8727)

CVE-2026-8827 (GCVE-0-2026-8827)

Tags

Sightings

Nomenclature