TYPO3 CMS vulnerabilities

TYPO3 forms using FileUpload or ImageUpload elements with a custom saveToFileMount stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. As a result, files could end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages.

Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.

A deserialization flaw in TYPO3's mail-file spool allows local users with write access to the spool directory to craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.

In TYPO3 CMS, backend users with access to the recycler module could delete arbitrary data from any database table defined in the TCA, regardless of their permissions to that table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.

Backend administrators without system maintainer privileges can schedule configuration:read, configuration:set, and configuration:show commands. This allows them to modify system configuration, potentially gaining system maintainer privileges or causing denial of service.

Several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements outside their permitted range. Exploitation requires a low-privileged backend user account. Affects TYPO3 CMS versions 10.0.0-10.4.59, 11.0.0-11.5.53, 12.0.0-12.4.48, 13.0.0-13.4.34, and 14.0.0-14.3.6.

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.

A vulnerability in TYPO3 CMS allows users to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.

Backend users with file download permissions can download files from the fallback storage of the file abstraction layer (FAL) via the Media Module, potentially exposing sensitive files like logs. Affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.

Backend users with write access to the form_definition table can directly create, update, or delete form definitions via DataHandler, bypassing Form Framework validation and permission checks. This allows arbitrary form configurations, SQL injection, and privilege escalation.

TYPO3 CMS has a vulnerability in the cache frontend (VariableFrontend) and persistent key-value store (Registry) where PHP payloads are deserialized without integrity validation or class restrictions. An attacker with write access to the backend (e.g., SQL database) can inject a crafted payload leading to remote code execution.

In TYPO3 CMS, the GeneralUtility::isAllowedAbsPath() function performed a plain string prefix comparison without requiring a directory separator boundary, allowing administrators with File Abstraction Layer access to create file storage definitions outside the project root.

Authenticated backend users could retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Backend users could insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, allowing them to gather information about records and files they were not authorized to view. This affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.

Backend users could move records to a different page without having edit permissions on the source page. This affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

Backend users with access to the Recycler module could restore soft-deleted records on pages or for tables they were not authorized to modify. This affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Editors with access to create or modify page content could include HTML markup in page titles stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.

The GeneralUtility::sanitizeLocalUrl function in TYPO3 CMS incorrectly validates URLs, allowing open redirect attacks. After passing sanitization, the URL can redirect users to external sites. This affects versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.

Backend users with file write permissions can upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass Form Framework restrictions. Malicious files can execute arbitrary SQL statements, allowing privilege escalation by creating admin accounts.

Non-privileged backend users with file mount access can perform write operations on folders representing the root of an active file mount due to missing authorization restrictions.

Backend users with access to the Form Framework can use files not ending in .form.yaml as form definitions, which are processed without denying the incorrect extension. Malicious form definition files can execute arbitrary SQL statements, enabling privilege escalation and admin account creation.