Skip to content
OpenAdvisories
Critical WID-SEC-2026-3003 21 CVEs

TYPO3 Extensions: Mehrere Schwachstellen

Published Aug 25, 2026 · Updated Aug 25, 2026 · de-DE

Vendor: TYPO3 Product: Extension Product: Extension SYSSY-TYPO3 Monitoring & Security Checks <3.0.6 Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection durchzuführen, erweiterte Berechtigungen zu erlangen, Daten zu manipulieren, sensible Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand auszulösen.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 21

  • Critical 9.5
    CVE-2026-77136

    Server-Side Template Injection in extension "powermail" (powermail)

    The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template…

    TYPO3 Extension "powermail"
  • Critical 9.3
    CVE-2026-77138

    Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

    The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code E…

    TYPO3 Extension "HTML5 Video Player vs. Powermail"
  • High 8.8
    CVE-2026-77141

    Broken Access Control in extension "Club Directory" (clubdirectory)

    The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no ownership check in any of them. An unauthenticated visitor who knows the UID of a club record can send a …

    TYPO3 Extension "Club Directory"
  • High 8.8
    CVE-2026-77142

    Broken Access Control in extension "Industry Directory" (yellowpages2)

    The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own, but the corresponding write operation does not repeat this ownership check on the server side. As a …

    TYPO3 Extension "Industry Directory"
  • High 8.7
    CVE-2026-77140

    Broken Access Control in extension "Telephone Directory" (telephonedirectory)

    The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An unauthenticated visitor who knows the UID of a visible employee record can send a direct POST reque…

    TYPO3 Extension "Telephone Directory"
  • High 8.3
    CVE-2026-77134

    Broken Access Control in extension "femanager" (femanager)

    The extension fails to require the dedicated admin confirmation token when processing an admin-approval request, so a regular user confirmation hash, obtainable by any visitor through the public resend-confirmation action, is sufficient to self-approve a pend…

    TYPO3 Extension "femanager"
  • High 8.3
    CVE-2026-77146

    Broken Access Control in extension "femanager" (femanager)

    The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), allowing an unauthenticated attacker to set a new password for and re-enable an arbitrary existing fron…

    TYPO3 Extension "femanager"
  • High 8.2
    CVE-2026-77135

    Information Disclosure in extension "femanager" (femanager)

    The extension's user detail view fails to verify that a requested user record matches the configured or logged-in target, allowing any visitor with access to the Detail or List plugin to retrieve another frontend user's profile data, including name, email, da…

    TYPO3 Extension "femanager"
  • High 7.7
    CVE-2026-56095

    Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

    The extension's indexer passed every field value returned by content object rendering through PHP's unserialize() function when transferring multi-value data for the SOLR_CLASSIFICATION, SOLR_MULTIVALUE and SOLR_RELATION content object types, rather than a sa…

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" Web / CMS
  • High 7.7
    CVE-2026-77129

    Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)

    The extension passes an editor-configurable email subject string directly into a Fluid template source without restriction. A backend user with edit access to the event plugin or Backend Module can supply Fluid ViewHelper syntax in this field to disclose sens…

    TYPO3 Extension "Event management and registration"
  • High 7.7
    CVE-2026-77137

    SQL Injection in extension "Forms Export" (frp_form_answers)

    The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileg…

    TYPO3 Extension "Forms Export"
  • High 7.6
    CVE-2026-56092

    Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

    The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited …

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" Web / CMS
  • Medium 6.3
    CVE-2026-56093

    Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

    The extension's frontend detail-view document lookup does not apply the current site's siteHash filter or frontend user access filter, unlike the regular search path. A visitor who can obtain or guess a valid Solr document id can retrieve documents through th…

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" Web / CMS
  • Medium 6.3
    CVE-2026-56094

    Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

    The extension allows a request-provided additionalFilters parameter to register a named siteHash filter before the system's own siteHash filter is applied, and the query builder does not overwrite an already-registered named filter. In a shared Solr core serv…

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" Web / CMS
  • Medium 6.3
    CVE-2026-56096 Public exploit

    Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

    The extension passes the user-supplied search query parameter to Apache Solr without restricting advanced Solr query syntax such as wildcards, field selectors and range queries. A remote, unauthenticated attacker can use this syntax to enumerate indexed field…

    TYPO3 Extension "Apache Solr for TYPO3 - Enterprise Search" Web / CMS
  • Medium 6.3
    CVE-2026-77128

    Broken Access Control in extension "Event management and registration" (sf_event_mgt)

    The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. …

    TYPO3 Extension "Event management and registration"
  • Medium 6.0
    CVE-2026-77127

    Information Disclosure in extension "Modules" (modules)

    The extension fails to restrict a backend AJAX endpoint for inline editing to fields the current user is permitted to see or edit. An authenticated, low-privileged backend user can supply arbitrary table, field and record parameters, and trigger an error resp…

    TYPO3 Extension "Modules"
  • Medium 6.0
    CVE-2026-77133

    Broken Access Control in extension "femanager" (femanager)

    The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field configuration, allowing self-service privilege escalation into arbitrary frontend groups.

    TYPO3 Extension "femanager"
  • Medium 6.0
    CVE-2026-77139

    Path Traversal in extension "Mask" (mask)

    The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal seq…

    TYPO3 Extension "Mask"
  • Medium 5.3
    CVE-2026-77130

    Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

    The extension fails to properly validate the expiration of a client-supplied JWT token, allowing an attacker in control of a valid API key to authenticate with an expired token. Exploitation requires the attacker to already be in control of the SYSSY project'…

    TYPO3 Extension "SYSSY - TYPO3 Monitoring & Security Checks" Web / CMS
  • Medium 5.3
    CVE-2026-77131

    Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)

    When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

    TYPO3 Extension "SYSSY - TYPO3 Monitoring & Security Checks" Web / CMS

Revision history

  1. #1

    Initiale Fassung

References