Description
The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | typo3-src | 4.0.2+debian-7 | DSA-1711-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms | >= 4.0.0, < 4.0.10 | 4.0.10 | GHSA-74w6-ww7w-45j9 |
| Packagist | typo3/cms | >= 4.1.0, < 4.1.8 | 4.1.8 | GHSA-74w6-ww7w-45j9 |
| Packagist | typo3/cms | >= 4.2.0, < 4.2.4 | 4.2.4 | GHSA-74w6-ww7w-45j9 |
Advisories 1
- DSA-1711-1 typo3-src - remote code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/
- 33617 third-party-advisory
- DSA-1711 vendor-advisory
- typo3-indexedsearch-command-execution(48138) vdb-entry
- 33376 vdb-entry
- [oss-security] 20090123 Re: CVE id request: typo3 SA-2009-001 mailing-list
- 33679 third-party-advisory