Description
The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1 leaks a hash secret (juHash) in an error message, which allows remote attackers to read arbitrary files by including the hash in a request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | typo3-src | 4.2.5-1+lenny1 | DTSA-193-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Typo3 sa-2009-002 File Disclosure
auxiliary/admin/http/typo3_sa_2009_002
Exploit-DB 1
- TYPO3 < 4.0.12/4.1.10/4.2.6 - 'jumpUrl' Remote File Disclosure EDB-8038 · webapps · Feb 10, 2009 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms | >= 3.3, < 4.0.12 | 4.0.12 | GHSA-c22j-84c7-cm77 |
| Packagist | typo3/cms | >= 4.1, < 4.1.10 | 4.1.10 | GHSA-c22j-84c7-cm77 |
| Packagist | typo3/cms | >= 4.2, < 4.2.6 | 4.2.6 | GHSA-c22j-84c7-cm77 |
Advisories 1
- DTSA-193-1 typo3 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20090210 CVE request: typo3 xss (typo3-sa-2009-002) mailing-list
- DSA-1720 vendor-advisory
- 1021710 vdb-entry
- http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-002/