SQL Injection in t3/dce

MEDIUM 4.9CVE-2021-31777 · GHSA-5v5h-4w2g-gxxc · Published 28/04/2021 · updated 17/06/2026

In short

CVE-2021-31777 is a MEDIUM (CVSS 4.9) vulnerability affecting t3/dce, dynamic content elements (dynamic content elements project).
Chance of exploitation in the next 30 days (EPSS): 1.4%, higher than 72.7% of all vulnerabilities.
Fix: update to 2.6.2, 2.7.1 or later.

Package	Affected versions	Patched versions
t3/dce Packagist	`≥ 2.2.0, < 2.6.2`	`2.6.2`
dynamic content elements dynamic_content_elements_project	`≥ 2.2.0, < 2.6.2≥ 2.7.0, < 2.7.1`	`2.6.22.7.1`

Description

The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.

NVD description

The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.

References

nvd.nist.gov/vuln/detail/CVE-2021-31777 · ADVISORY
bitbucket.org/ArminVieweg/dce/commits/998a2392f69f2153797c5ace6e8914ca309e70c7 · WEB
excellium-services.com/cert-xlm-advisory · WEB
packagist.org/packages/t3/dce · WEB
typo3.org/security/advisory/typo3-ext-sa-2021-005 · WEB
packetstormsecurity.com/files/162429/TYPO3-6.2.1-SQL-Injection.html · WEB
cds.thalesgroup.com/en/tcs-cert/CVE-2021-31777
excellium-services.com/cert-xlm-advisory · Not Applicable

More vulnerabilities in t3/dce

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free