CVE-2026-6553

A deserialization flaw in TYPO3's mail-file spool allows local users with write access to the spool directory to craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.

In TYPO3 CMS, backend users with access to the recycler module could delete arbitrary data from any database table defined in the TCA, regardless of their permissions to that table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

A vulnerability in TYPO3 CMS allows users to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.

Backend users with file download permissions can download files from the fallback storage of the file abstraction layer (FAL) via the Media Module, potentially exposing sensitive files like logs. Affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.

Backend users with write access to the form_definition table can directly create, update, or delete form definitions via DataHandler, bypassing Form Framework validation and permission checks. This allows arbitrary form configurations, SQL injection, and privilege escalation.

TYPO3 CMS has a vulnerability in the cache frontend (VariableFrontend) and persistent key-value store (Registry) where PHP payloads are deserialized without integrity validation or class restrictions. An attacker with write access to the backend (e.g., SQL database) can inject a crafted payload leading to remote code execution.

In TYPO3 CMS, the GeneralUtility::isAllowedAbsPath() function performed a plain string prefix comparison without requiring a directory separator boundary, allowing administrators with File Abstraction Layer access to create file storage definitions outside the project root.

Authenticated backend users could retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Backend users could insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, allowing them to gather information about records and files they were not authorized to view. This affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.