Summary
Ein Angreifer kann mehrere Schwachstellen in TYPO3 Extension ausnutzen, um Dateien zu manipulieren.
Product
TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Vulnerabilities 2
-
Medium 5.3
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead of S3's metadata…
-
Medium 5.2
Insecure Deserialization in extension "Mailqueue" (mailqueue)
The extension extends TYPO3’ FileSpool component, which was vulnerable to Insecure Deserialization prior to TYPO3-CORE-SA-2026-004 https://typo3.org/security/advisory/typo3-core-sa-2026-004 . Since the related fix is overwritten by the extension, using the ex…
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2026-3591
-
#1
Initiale Fassung
References
-
TYPO3 Security Advisory vom 2026-01-19
https://typo3.org/security/advisory/typo3-ext-sa-2026-001
-
TYPO3 Security Advisory vom 2026-01-19
https://typo3.org/security/advisory/typo3-ext-sa-2026-002
-
TYPO3 Security Advisory vom 2026-01-19
https://typo3.org/security/advisory/typo3-ext-sa-2026-003
-
TYPO3 Security Advisory vom 2026-01-19
https://typo3.org/security/advisory/typo3-ext-sa-2026-004