# typo3/cms-backend (Packagist) vulnerabilities 26 known vulnerabilities (3 high, 10 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/typo3/cms-backend ## Advisories (26) ### [CVE-2026-77132](https://cve.now/CVE-2026-77132): TYPO3 CMS - Information Disclosure via Backend Localization Wizard - Severity: Medium 5.3 - Published: Sep 8, 2026 - Affected: from 10.0.0, fixed in 10.4.60; from 11.0.0, fixed in 11.5.54; from 12.0.0, fixed in 12.4.49; from 13.0.0, fixed in 13.4.35; from 14.0.0, fixed in 14.3.7. ### [CVE-2026-19418](https://cve.now/CVE-2026-19418): TYPO3 CMS - Broken Access Control in Backend and Install Tool - Severity: High 7.3 - Published: Aug 11, 2026 - Affected: from 13.0.0, fixed in 13.4.34; from 14.0.0, fixed in 14.3.6; from 13.0.0, fixed in 13.4.34. ### [CVE-2026-47352](https://cve.now/CVE-2026-47352): TYPO3 CMS - Broken Access Control in Backend API - Severity: Medium 5.3 - Published: Jun 9, 2026 - Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3. ### [CVE-2026-47351](https://cve.now/CVE-2026-47351): TYPO3 CMS - Broken Access Control in Clipboard - Severity: Medium 5.3 - Published: Jun 9, 2026 - Affected: from 10.4.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3. ### [CVE-2026-6553](https://cve.now/CVE-2026-6553): TYPO3 CMS Stores Cleartext Password in User Settings Module - Severity: High 7.3 - Published: Apr 21, 2026 - Affected: from 14.2.0, fixed in 14.3.0; from 14.2.0, fixed in 14.3.0. ### [CVE-2025-59020](https://cve.now/CVE-2025-59020): TYPO3 CMS Allows Broken Access Control in Edit Document Controller - Severity: Medium 5.3 - Published: Jan 13, 2026 - Affected: from 10.0.0, fixed in 10.4.55; from 11.0.0, fixed in 11.5.49; from 12.0.0, fixed in 12.4.41; from 13.0.0, fixed in 13.4.23; from 14.0.0, fixed in 14.0.2; from 14.0.0, fixed in 14.0.2; from 13.0.0, fixed in 13.4.23; from 12.0.0, fixed in 12.4.41; from 11.0.0, fixed in 11.5.49; from 10.0.0, fixed in 10.4.55. ### [CVE-2025-59019](https://cve.now/CVE-2025-59019): Information Disclosure via CSV Download - Severity: Medium 5.3 - Published: Sep 9, 2025 - Affected: from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18. ### [CVE-2025-59017](https://cve.now/CVE-2025-59017): Broken Access Control in Backend AJAX Routes - Severity: Medium 5.3 - Published: Sep 9, 2025 - Affected: from 9.0.0, fixed in 9.5.55; from 10.0.0, fixed in 10.4.54; from 11.0.0, fixed in 11.5.48; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 9.0.0, fixed in 12.4.37; from 10.0.0, fixed in 12.4.37; from 11.0.0, fixed in 12.4.37; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18. ### [CVE-2025-59014](https://cve.now/CVE-2025-59014): Denial of Service in TYPO3 Bookmark Toolbar - Severity: Medium 5.1 - Published: Sep 9, 2025 - Affected: from 11.0.0, fixed in 11.5.48; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 11.0.0, fixed in 12.4.37; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18. ### [CVE-2025-47941](https://cve.now/CVE-2025-47941): TYPO3 Has Broken Authentication in Backend MFA - Severity: High 7.2 - Published: May 20, 2025 - Affected: from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12. ### [CVE-2024-34537](https://cve.now/CVE-2024-34537): TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an… - Severity: Medium 4.9 - Published: Oct 28, 2024 - Affected: from 13.0.0, fixed in 13.3.1; from 12.0.0, fixed in 12.4.21; from 11.0.0, fixed in 11.5.40; from 10.0.0, fixed in 10.4.46. ### [CVE-2024-47780](https://cve.now/CVE-2024-47780): Information Disclosure in TYPO3 Page Tree - Severity: Low 3.1 - Published: Oct 8, 2024 - Affected: from 13.0.0, fixed in 13.3.1; from 12.0.0, fixed in 12.4.21; from 11.0.0, fixed in 11.5.40; from 10.0.0, fixed in 10.4.46. ### [CVE-2021-21370](https://cve.now/CVE-2021-21370): Cross-Site Scripting in Content Preview (CType menu) - Severity: Medium 5.4 - Published: Mar 23, 2021 - Affected: from 7.0.0, fixed in 7.6.51; from 8.0.0, fixed in 8.7.40; from 9.0.0, fixed in 9.5.25; from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1. ### [CVE-2021-21340](https://cve.now/CVE-2021-21340): Cross-Site Scripting in Content Preview - Severity: Medium 5.4 - Published: Mar 23, 2021 - Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1. ### [CVE-2010-3664](https://cve.now/CVE-2010-3664): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend. - Severity: Unrated - Published: Nov 4, 2019 - Affected: fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1. ### [CVE-2010-3663](https://cve.now/CVE-2010-3663): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable… - Severity: Unrated - Published: Nov 4, 2019 - Affected: fixed in 4.1.14; from 4.2, fixed in 4.2.13; from 4.3, fixed in 4.3.4; from 4.4, fixed in 4.4.1. ### [CVE-2010-3662](https://cve.now/CVE-2010-3662): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend. - Severity: Unrated - Published: Nov 4, 2019 - Affected: fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1. ### [CVE-2010-3661](https://cve.now/CVE-2010-3661): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend. - Severity: Unrated - Published: Nov 1, 2019 - Affected: fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1. ### [CVE-2010-3660](https://cve.now/CVE-2010-3660): TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend. - Severity: Unrated - Published: Nov 1, 2019 - Affected: fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1. ### [CVE-2010-3659](https://cve.now/CVE-2010-3659): Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x… - Severity: Unrated - Published: Oct 20, 2017 - Affected: from 4.1.0, fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1. ### [CVE-2010-3715](https://cve.now/CVE-2010-3715): Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote… - Severity: Unrated - Published: Oct 25, 2010 - Affected: from 4.2.0, fixed in 4.2.15; from 4.3.0, fixed in 4.3.7; from 4.4.0, fixed in 4.4.4. ### [CVE-2009-3631](https://cve.now/CVE-2009-3631): The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2, when the DAM… - Severity: Unrated - Published: Nov 2, 2009 - Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2. ### [CVE-2009-3630](https://cve.now/CVE-2009-3630): The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote… - Severity: Unrated - Published: Nov 2, 2009 - Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2. ### [CVE-2009-3629](https://cve.now/CVE-2009-3629): Multiple cross-site scripting (XSS) vulnerabilities in the Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x… - Severity: Unrated - Published: Nov 2, 2009 - Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2. ### [CVE-2009-3628](https://cve.now/CVE-2009-3628): The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote… - Severity: Unrated - Published: Nov 2, 2009 - Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2. ### [CVE-2008-5644](https://cve.now/CVE-2008-5644): Cross-site scripting (XSS) vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script… - Severity: Unrated - Published: Dec 17, 2008 - Affected: from 4.2.2, fixed in 4.2.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/typo3/cms-backend Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.