Skip to content
OpenAdvisories
High WID-SEC-2026-1585 8 CVEs

TYPO3 Extensions: Mehrere Schwachstellen

Published May 18, 2026 · Updated May 19, 2026 · Revision 2 · de-DE

Vendor: TYPO3 Product: Extension Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 8

  • Critical 9.2
    CVE-2026-46725 Scanner template

    Remote Code Execution in extension "Content Element Selector" (ceselector)

    The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Executio…

    TYPO3 Extension "Content Element Selector" mmc/ceselector Packagist
  • High 8.2
    CVE-2026-8726 Public exploit

    SQL Injection in extension "News system" (news)

    The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires th…

    TYPO3 Extension "News system" georgringer/news Packagist
  • High 8.2
    CVE-2026-8827

    SQL Injection in extension "Address List" (tt_address)

    The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installati…

    TYPO3 Extension "Address List" friendsoftypo3/tt-address Packagist
  • High 7.1
    CVE-2026-8727

    Remote Code Execution in extension "Site Crawler" (crawler)

    The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. …

    TYPO3 Extension "Site Crawler" tomasnorre/crawler Packagist
  • Medium 6.9
    CVE-2026-46721

    Broken Access Control in extension "Frontend User Registration" (sf_register)

    The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited acco…

    TYPO3 Extension "Frontend User Registration" evoweb/sf-register Packagist
  • Medium 5.9
    CVE-2026-46722

    XML External Entity Injection in extension "Faceted Search" (ke_search)

    The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed directory can cause local files to be read or outbound HTTP requests to be performed, with the retrieved content being writ…

    TYPO3 Extension "Faceted Search" tpwd/ke_search Packagist
  • Medium 5.9
    CVE-2026-46723

    Information Disclosure in extension "Faceted Search" (ke_search)

    The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permission to edit indexer configurations can copy sensitive data from internal TYPO3 tables into the search index.

    TYPO3 Extension "Faceted Search" tpwd/ke_search Packagist
  • Medium 5.9
    CVE-2026-46724

    Path Traversal in extension "Faceted Search" (ke_search)

    The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index documents from arbitrary locations on the server file system through path traversal sequences.

    TYPO3 Extension "Faceted Search" tpwd/ke_search Packagist

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-30865, EUVD-2026-30866, EUVD-2026-30864, EUVD-2026-30863, EUVD-2026-30859, EUVD-2026-30861, EUVD-2026-30857, EUVD-2026-30854

  2. #1

    Initiale Fassung

References