TYPO3 Security Releases June 2026: 5 critical vulnerabilities explained
Listen to article
On June 9, 2026, TYPO3 published 14 security advisories. This overview explains the five most important ones and shows you which version you should install.
In a nutshell: On June 9, 2026, the TYPO3 team published 14 Security Advisories. All maintained versions from v10 to v14 and the associated ELTS series are affected. Five advisories are classified as "High", the others as "Medium" or "Low". Important: The bug-fixed versions are already available, so an update is possible immediately. Anyone running a TYPO3 installation should update as soon as possible.
On June 9, 2026, the TYPO3 team released a major package of security updates. A total of 14 security advisories describe vulnerabilities in the core and in supplied system extensions. Most of them concern access control in the backend, plus cross-site scripting, an open redirect and insecure deserialization.
In practice, this means that the vulnerabilities can generally only be exploited by logged-in backend users. This reduces the risk, but does not eliminate it. Especially in setups with many editors or external service providers, every clean rights boundary counts. Anyone using affected versions should therefore not leave the updates lying around.
You should install these versions
The fixes are included in the following versions:
- TYPO3 14.3.3 LTS
- TYPO3 13.4.31 LTS
- TYPO3 12.4.46 ELTS
- TYPO3 11.5.51 ELTS
- TYPO3 10.4.57 ELTS
No further database updates are necessary for the maintenance releases. The ELTS versions are available to customers with active Extended Long-Term Support.
You can find the official TYPO3 announcements here:
- TYPO3 14.3.3 and 13.4.31 security releases published
- TYPO3 10.4.57, 11.5.51 and 12.4.46 ELTS released
The five high messages in detail
Four of the five critical releases relate to the Form Framework and file management. It is worth taking a closer look here.
Privilege escalation and SQL injection in the Form Framework (SA-2026-017). Backend users with write access to the form_definition table were able to create, change or delete form definitions directly via the DataHandler, bypassing the validation and privilege checks of the Form Framework. SQL injection and the creation of administrative accounts were possible via manipulated definitions. Only TYPO3 v14 (14.0.0 to 14.3.2) is affected. Original: TYPO3-CORE-SA-2026-017
Broken Access Control in the Form Framework, Part 1 (SA-2026-008). Backend users with write access to files could upload form definitions with mixed upper and lower case extensions, such as .FORM.YAML, and thus bypass the upload restriction. This could also be used to execute SQL commands and create administrator accounts. Affected are v10 to v14. Original: TYPO3-CORE-SA-2026-008
Broken Access Control in the Form Framework, Part 2 (SA-2026-019). Similar pattern, different path: Files that did not end in .form.yaml were still processed as form definitions without rejecting the wrong extension. This resulted in SQL execution again and possible privilege escalation. Affected are v10 to v14. Original: TYPO3-CORE-SA-2026-019
Broken access control in the file abstraction layer (SA-2026-007). Non-privileged backend users with access to a file mount could perform write operations such as move, delete or rename on the root folder of an active mount because an authorization check was missing. Affected are v10 to v14. Original: TYPO3-CORE-SA-2026-007
Broken access control in the media module (SA-2026-013). Backend users with download rights were able to download files from the fallback memory of the file abstraction layer via the media module. As this memory resolves paths relative to the document root, sensitive files such as log files could be accessed. Affected are v11 to v14. Original: TYPO3-CORE-SA-2026-013
A brief overview of the other notifications
The other nine advisories are classified as "Medium" or "Low". They will also be closed with the updates mentioned:
- SA-2026-006: Bypassing XSS protection in HTML Sanitizer (Medium)
- SA-2026-009: Open redirect via sanitizeLocalUrl in the core utilities (Medium)
- SA-2026-010: Cross-site scripting in Indexed Search via unfiltered page titles (Medium)
- SA-2026-011: Broken access control in the recycler when restoring data records (Medium)
- SA-2026-012: Broken access control in DataHandler when moving data records (Medium)
- SA-2026-014: Broken Access Control in clipboard without read check (Medium)
- SA-2026-015: Broken access control in the backend API when retrieving file metadata (Medium)
- SA-2026-016: Broken access control during path check in the file abstraction layer (Low)
- SA-2026-018: Insecure deserialization in cache and registry of the core API (Medium)
What you should do now
Check which TYPO3 version your projects are using and plan the update to the appropriate target version. For v13 and v14 these are the regular LTS releases, for v10 to v12 the ELTS versions. If you actively use the Form Framework or give many backend users file and write permissions, you should prioritize the update. In most cases, an update of the affected packages via Composer and a subsequent test in the backend is sufficient.
Conclusion
The collective release of June 9, 2026 is manageable in terms of effort, but relevant for every running installation. Five high messages relating to Form Framework and file management set the pace, while nine others close smaller gaps. If you are working on a maintained version and install the update, you are on the safe side. The original advisories provide the technical details for each case.
BackDo you have a question or want to discuss the topic?
In the Community Hub for TYPO3 you can exchange ideas with other TYPO3 users. And if you don't want to miss any new articles: The TYPO3 Newsletter comes once a month, without spam.
