Skip to content
OpenAdvisories
Medium WID-SEC-2026-4053 15 CVEs

TYPO3 Extensions: Mehrere Schwachstellen

Published Oct 19, 2026 · Updated Oct 20, 2026 · Revision 2 · de-DE

Vendor: TYPO3 Product: Extension Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Extension ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen, um einen SQL-Injection Angriff durchzuführen, um einen Cross-Site Scripting Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.

Product

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Vulnerabilities 15

  • High 8.7
    CVE-2026-112238

    SQL Injection in extension "File manager" (ameos_filemanager)

    The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended strin…

    TYPO3 Extension "File manager"
  • High 7.2
    CVE-2026-112239

    Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)

    The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any…

    TYPO3 Extension "TYPO3 AI Integration Extension" Web / CMS
  • High 7.1
    CVE-2026-112064

    SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)

    The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation. Only the filter conditions of that query were bound as parameters. A backend user with acc…

    TYPO3 Extension "sgalinski Cookie Consent"
  • High 7.1
    CVE-2026-112066

    Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

    The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

    TYPO3 Extension "sgalinski Cookie Consent"
  • High 7.1
    CVE-2026-113459

    Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)

    In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser. Any authenticated backend user can read the key and use it at the expe…

    TYPO3 Extension "TYPO3 AI Integration Extension" Web / CMS
  • Medium 6.9
    CVE-2026-112067

    Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)

    The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default conf…

    TYPO3 Extension "Accessible Form Captcha"
  • Medium 6.9
    CVE-2026-112071 Public exploit

    Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

    The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the…

    TYPO3 Extension "TYPO3 Shop by coding.ms" Web / CMS
  • Medium 6.9
    CVE-2026-112237

    Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)

    The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor. For one HTTP request method, the endpoint does not apply the authorization check that protects the other methods, so the URL it fetches is fully controlled by the requ…

    TYPO3 Extension "Kitodo.Presentation"
  • Medium 6.9
    CVE-2026-113468 Public exploit

    Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

    The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with arbitrary content. Thi…

    TYPO3 Extension "TYPO3 Shop by coding.ms" Web / CMS
  • Medium 6.3
    CVE-2026-112069

    Broken Access Control in extension "FAL Protect" (fal_protect)

    The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when t…

    TYPO3 Extension "FAL Protect"
  • Medium 6.3
    CVE-2026-112240

    Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

    The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other vis…

    TYPO3 Extension "TYPO3 Fluid-Form by coding.ms" Web / CMS
  • Medium 5.3
    CVE-2026-112065

    Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

    The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve consent data of any site …

    TYPO3 Extension "sgalinski Cookie Consent"
  • Medium 5.3
    CVE-2026-112068

    Insecure Direct Object Reference in extension "Analytics" (analytics)

    The backend module does not check whether a backend user has access to the requested site. Users with access to the module can therefore open the analytics dashboard of any site.

    TYPO3 Extension "Analytics"
  • Medium 5.3
    CVE-2026-112070

    Broken Access Control in extension "Analytics" (analytics)

    The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

    TYPO3 Extension "Analytics"
  • Medium 5.3
    CVE-2026-113442

    Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

    Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

    TYPO3 Extension "TYPO3 Fluid-Form by coding.ms" Web / CMS

Revision history

  1. #2

    Referenz(en) aufgenommen: CVE-2026-113442, EUVD-2026-104868, CVE-2026-113468, EUVD-2026-104865, CVE-2026-112240, EUVD-2026-104869, CVE-2026-112239, EUVD-2026-104864, CVE-2026-113459, EUVD-2026-104863, CVE-2026-112238, EUVD-2026-104867, CVE-2026-112237, EUVD-2026-104870, CVE-2026-112067, EUVD-2026-104872, CVE-2026-112068, EUVD-2026-104871, CVE-2026-112070, EUVD-2026-104862, EUVD-2026-104873, EUVD-2026-104875, EUVD-2026-104876, EUVD-2026-104874, CVE-2026-112071, EUVD-2026-104866

  2. #1

    Initiale Fassung

References