TYPO3: 24 Vulnerabilities Disclosed, Including Critical RCE and Code Execution Flaws
A coordinated disclosure on August 25, 2026, revealed 24 vulnerabilities in TYPO3, including critical flaws enabling RCE and arbitrary code execution.
Key findings
- 24 TYPO3 vulnerabilities disclosed on August 25, 2026, ranging from Medium to Critical severity.
- Critical flaws include RCE via PHP Object Injection (CVE-2026-77138) and arbitrary code execution via Fluid template injection (CVE-2026-77136).
- Multiple high-severity issues allow unauthorized data modification and account takeovers in frontend management features.
- Several vulnerabilities impact Solr integration, enabling data enumeration and bypass of access controls.
- Patches are available; immediate updates are crucial for all TYPO3 installations.
On August 25, 2026, a significant batch of 24 vulnerabilities was disclosed for TYPO3, a popular open-source content management system. These vulnerabilities, ranging in severity from Medium to Critical, were all published on the same day, indicating a coordinated disclosure event. The flaws impact various aspects of TYPO3, including user authentication, data handling, and access control, with several allowing for unauthorized data access or modification.
A cluster of high-severity vulnerabilities (CVE-2026-77146, CVE-2026-77145, CVE-2026-77144, CVE-2026-77143, CVE-2026-77142, CVE-2026-77141, CVE-2026-77140) primarily concern insufficient server-side validation in frontend management features. Attackers could exploit these to reset passwords, re-enable user accounts, modify events belonging to other organizers, overwrite forum topics, or alter company and club records without proper authorization.
Two critical vulnerabilities stand out: CVE-2026-77138, a PHP Object Injection flaw in an extension that could lead to Remote Code Execution due to improper handling of unserialized user input. Another critical flaw, CVE-2026-77136, allows anonymous, unauthenticated users to execute arbitrary Fluid ViewHelpers by injecting Fluid template syntax into a form field, potentially leading to code execution.
Several medium-severity vulnerabilities (CVE-2026-77139, CVE-2026-77137, CVE-2026-77133, CVE-2026-77129, CVE-2026-77128, CVE-2026-77127, CVE-2026-56096, CVE-2026-56094, CVE-2026-56093, CVE-2026-56092) involve issues such as path traversal in file operations, SQL injection in backend modules, privilege escalation through self-service profile edits, disclosure of sensitive data via Fluid templates, bypassing access restrictions for events and records, and cache poisoning leading to unauthorized access to restricted pages.
Additionally, vulnerabilities related to data handling with Apache Solr were disclosed, including CVE-2026-56096, which allows attackers to enumerate and extract data using advanced Solr query syntax, and CVE-2026-56095, where unserialization of content object data could lead to further exploitation. CVE-2026-56094 and CVE-2026-56093 also relate to Solr, enabling unauthorized access to data across different TYPO3 sites or bypassing access restrictions on cached documents.
The batch also includes vulnerabilities in the SYSSY project integration, specifically CVE-2026-77135 (disclosure of user profile data), CVE-2026-77131 (cleartext transmission of system information), and CVE-2026-77130 (exploitation of expired JWT tokens). CVE-2026-77134 addresses an issue where regular user confirmation hashes could be used to approve pending accounts, bypassing administrator approval.
Users are strongly advised to update their TYPO3 installations to patched versions as soon as possible to mitigate these widespread security risks. The coordinated disclosure of these numerous vulnerabilities underscores the importance of timely patching and security vigilance for TYPO3 administrators.
The full list of affected CVEs includes: CVE-2026-77146, CVE-2026-77145, CVE-2026-77144, CVE-2026-77143, CVE-2026-77142, CVE-2026-77141, CVE-2026-77140, CVE-2026-77139, CVE-2026-77138, CVE-2026-77137, CVE-2026-77136, CVE-2026-77135, CVE-2026-77134, CVE-2026-77133, CVE-2026-77131, CVE-2026-77130, CVE-2026-77129, CVE-2026-77128, CVE-2026-77127, CVE-2026-56096, CVE-2026-56095, CVE-2026-56094, CVE-2026-56093, CVE-2026-56092.