Typo3 patches critical RCE flaws across versions
Multiple vulnerabilities in Typo3 CMS allow remote code execution, privilege escalation, XSS, and SQL injection; patches available for versions 10-14.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 10 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
The French CERT has issued an advisory concerning multiple security vulnerabilities discovered in the Typo3 content management system. The flaws affect all supported Typo3 versions from 10.x through 14.x, with patches released on June 9, 2026. The vulnerabilities enable attackers to execute arbitrary code remotely, escalate privileges, bypass security policies, perform SQL injection attacks, and conduct cross-site scripting (XSS) attacks. Additional impacts include unauthorized access to confidential data and integrity violations.
Ten CVEs have been assigned to these vulnerabilities (CVE-2026-11607, CVE-2026-47348 through CVE-2026-47352, and CVE-2026-49738, CVE-2026-49740 through CVE-2026-49742), with corresponding GitHub security advisories published by the Typo3 project. Organizations running Typo3 should immediately upgrade to patched versions: 10.4.57, 11.5.51, 12.4.46, 13.4.31, or 14.3.3 depending on their deployment.
Given the severity of remote code execution capabilities and the widespread use of Typo3 in enterprise environments, particularly in European organizations, these vulnerabilities represent a significant attack surface. Administrator-level access is likely required for exploitation of some flaws, but the combination of XSS and privilege escalation could enable attack chains starting from lower-privileged positions.
Mentioned in this report
Detection guidance
Suspicious PHP File Written to Typo3 Upload or Temp Directory
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of PHP files inside Typo3 writable directories (fileadmin, typo3temp, uploads) which are commonly abused to drop web shells after successful RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Dropped in Typo3 Writable Web Directory
id: d3e906b0-e34c-5f7d-bff7-ca723f472d70
status: experimental
description: Detects creation of .php files within Typo3 upload/temp directories such
as fileadmin, typo3temp, or uploads, which are not expected to contain executable
PHP code and are a common web shell drop location following exploitation of CMS
RCE vulnerabilities.
logsource:
category: file_event
product: linux
detection:
selection:
TargetFilename|contains:
- /fileadmin/
- /typo3temp/
- /uploads/
TargetFilename|endswith:
- .php
- .phtml
- .php5
condition: selection
falsepositives:
- Legitimate PHP-based extensions or templates intentionally installed by administrators
in these directories
- Backup or migration tooling that copies PHP source trees into upload directories
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0722
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,572 reports from 147 sources, 724 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs