# Typo3 patches critical RCE flaws across versions

Published: 2026-06-10 · Severity: high
Canonical: https://vorant.io/reports/19856ec2-0dd8-4686-af6d-270ecab37d23/typo3-patches-critical-rce-flaws-across-versions

> Multiple vulnerabilities in Typo3 CMS allow remote code execution, privilege escalation, XSS, and SQL injection; patches available for versions 10-14.

The French CERT has issued an advisory concerning multiple security vulnerabilities discovered in the Typo3 content management system. The flaws affect all supported Typo3 versions from 10.x through 14.x, with patches released on June 9, 2026. The vulnerabilities enable attackers to execute arbitrary code remotely, escalate privileges, bypass security policies, perform SQL injection attacks, and conduct cross-site scripting (XSS) attacks. Additional impacts include unauthorized access to confidential data and integrity violations.

Ten CVEs have been assigned to these vulnerabilities (CVE-2026-11607, CVE-2026-47348 through CVE-2026-47352, and CVE-2026-49738, CVE-2026-49740 through CVE-2026-49742), with corresponding GitHub security advisories published by the Typo3 project. Organizations running Typo3 should immediately upgrade to patched versions: 10.4.57, 11.5.51, 12.4.46, 13.4.31, or 14.3.3 depending on their deployment.

Given the severity of remote code execution capabilities and the widespread use of Typo3 in enterprise environments, particularly in European organizations, these vulnerabilities represent a significant attack surface. Administrator-level access is likely required for exploitation of some flaws, but the combination of XSS and privilege escalation could enable attack chains starting from lower-privileged positions.

## Mentioned in this report

- Vulnerabilities: CVE-2026-11607, CVE-2026-47348, CVE-2026-47349, CVE-2026-47350, CVE-2026-47351, CVE-2026-47352, CVE-2026-49738, CVE-2026-49740, CVE-2026-49741, CVE-2026-49742

## Detection guidance (public sample)

### Suspicious PHP File Written to Typo3 Upload or Temp Directory

ATT&CK: T1505.003

Detects creation of PHP files inside Typo3 writable directories (fileadmin, typo3temp, uploads) which are commonly abused to drop web shells after successful RCE exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: PHP File Dropped in Typo3 Writable Web Directory
id: d3e906b0-e34c-5f7d-bff7-ca723f472d70
status: experimental
description: Detects creation of .php files within Typo3 upload/temp directories such
  as fileadmin, typo3temp, or uploads, which are not expected to contain executable
  PHP code and are a common web shell drop location following exploitation of CMS
  RCE vulnerabilities.
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|contains:
    - /fileadmin/
    - /typo3temp/
    - /uploads/
    TargetFilename|endswith:
    - .php
    - .phtml
    - .php5
  condition: selection
falsepositives:
- Legitimate PHP-based extensions or templates intentionally installed by administrators
  in these directories
- Backup or migration tooling that copies PHP source trees into upload directories
level: high
tags:
- attack.t1505.003
- attack.t1190
author: Vorant
```

### Valid Account Login to Typo3 Backend Followed by Admin Configuration Change

ATT&CK: T1078

Detects successful authentication to the Typo3 backend admin interface followed shortly by extension installation or system configuration changes, which may indicate abuse of valid/compromised credentials combined with privilege escalation flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Typo3 Backend Login Followed by Extension or Config Change
id: ec4a0bd8-5e04-5a9f-931a-d8361114e1b9
status: experimental
description: Detects a Typo3 backend administrator login event followed by installation
  of an extension or modification of system configuration, which can indicate abuse
  of valid accounts combined with privilege escalation to achieve persistence or code
  execution.
logsource:
  category: application
  product: typo3
detection:
  selection_login:
    EventType: backend_login_success
  selection_change:
    EventType:
    - extension_install
    - system_configuration_change
    - admin_user_created
  condition: selection_login and selection_change
falsepositives:
- Legitimate administrator performing routine extension installation or configuration
  updates after login
- Scheduled maintenance windows where multiple admin actions occur in sequence
level: medium
tags:
- attack.t1078
- attack.t1190
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0722

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/19856ec2-0dd8-4686-af6d-270ecab37d23/typo3-patches-critical-rce-flaws-across-versions.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup