Medium severity6.5NVD Advisory· Published Sep 13, 2022· Updated Jun 17, 2026
CVE-2022-36107
CVE-2022-36107
Description
TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the FileDumpController (backend and frontend context) is vulnerable to cross-site scripting when malicious files are displayed using this component. A valid backend user account is needed to exploit this vulnerability. Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem. There are no known workarounds for this issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3/cms-corePackagist | >= 7.0.0, < 7.6.58 | 7.6.58 |
typo3/cms-corePackagist | >= 8.0.0, < 8.7.48 | 8.7.48 |
typo3/cms-corePackagist | >= 9.0.0, < 9.5.37 | 9.5.37 |
typo3/cms-corePackagist | >= 10.0.0, < 10.4.32 | 10.4.32 |
typo3/cms-corePackagist | >= 11.0.0, < 11.5.16 | 11.5.16 |
typo3/cmsPackagist | >= 10.0.0, < 10.4.32 | 10.4.32 |
typo3/cmsPackagist | >= 11.0.0, < 11.5.16 | 11.5.16 |
Affected products
4- osv-coords3 versions
>= 7.0.0, < 7.6.57+ 2 more
- (no CPE)range: >= 7.0.0, < 7.6.57
- (no CPE)range: >= 10.0.0, < 10.4.32
- (no CPE)range: >= 7.0.0, < 7.6.58
Patches
Vulnerability mechanics
References
8- github.com/TYPO3/typo3/commit/bd58d2ff2eeef89e63ef754a2389597d22622a39nvdPatchThird Party AdvisoryWEB
- github.com/TYPO3/typo3/security/advisories/GHSA-9c6w-55cp-5w25nvdThird Party AdvisoryWEB
- github.com/advisories/GHSA-9c6w-55cp-5w25ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-36107ghsaADVISORY
- typo3.org/security/advisory/typo3-core-sa-2022-009nvdVendor AdvisoryWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2022-36107.yamlghsaWEB
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2022-36107.yamlghsaWEB
- github.com/TYPO3/typo3/commit/546208428c861a09d62b86cde141eb19a81fae66ghsaWEB
News mentions
0No linked articles in our index yet.