High severityNVD Advisory· Published Jan 22, 2009· Updated Apr 23, 2026
CVE-2009-0258
CVE-2009-0258
Description
The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3/cmsPackagist | >= 4.0.0, < 4.0.10 | 4.0.10 |
typo3/cmsPackagist | >= 4.1.0, < 4.1.8 | 4.1.8 |
typo3/cmsPackagist | >= 4.2.0, < 4.2.4 | 4.2.4 |
Affected products
24cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*+ 23 more
- cpe:2.3:a:typo3:typo3:4.0:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:typo3:typo3:4.2.3:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
11- secunia.com/advisories/33617nvdVendor Advisory
- typo3.org/teams/security/security-bulletins/typo3-sa-2009-001/nvdVendor Advisory
- github.com/advisories/GHSA-74w6-ww7w-45j9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2009-0258ghsaADVISORY
- typo3.org/teams/security/security-bulletins/typo3-sa-2009-001ghsaWEB
- www.debian.org/security/2009/dsa-1711nvdWEB
- www.openwall.com/lists/oss-security/2009/01/23/4nvdWEB
- exchange.xforce.ibmcloud.com/vulnerabilities/48138nvdWEB
- web.archive.org/web/20111210005350/http://www.securityfocus.com/bid/33376ghsaWEB
- secunia.com/advisories/33679nvd
- www.securityfocus.com/bid/33376nvd
News mentions
0No linked articles in our index yet.