TYPO3 Cross-Site Scripting in Language Pack Handling

概要

参考情報

• FriendsOfPHP/security-advisories · WEB
• TYPO3-CMS/core · PACKAGE
• typo3.org/security/advisory/typo3-core-sa-2019-004 · WEB

typo3/cms-core のその他の脆弱性

• CVE-2026-19418高 7.3The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started …
• CVE-2026-49742高 7.1Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via t…
• CVE-2026-49741高 8.7Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition record…
• CVE-2026-49740中 6.3TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation o…
• CVE-2026-49738低 2.1The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory sepa…