# TYPO3 patches security bypass flaws

Published: 2026-08-18 · Severity: routine · Sectors: technology
Canonical: https://vorant.io/reports/815a299e-5ccb-5569-99f3-175233ebf7fa/typo3-patches-security-bypass-flaws

> TYPO3 CMS versions before 13.4.34 and 14.3.6 contain vulnerabilities allowing attackers to bypass security policy controls.

The French national cybersecurity agency (ANSSI/CERT-FR) published an advisory covering multiple vulnerabilities in TYPO3, an open-source content management system, affecting versions 13.x prior to 13.4.34 and 14.x prior to 14.3.6. The flaws allow an attacker to bypass security policy protections, though no active exploitation is mentioned in the advisory.

Two CVEs are tracked (CVE-2026-15305 and CVE-2026-19418), corresponding to GitHub Security Advisories GHSA-68jx-f42c-7599 and GHSA-mfqj-cqv3-h7xw published by the TYPO3 project on 17 August 2026. Administrators running affected TYPO3 versions should apply the vendor-provided patches referenced in the official security bulletins to remediate the security policy bypass issues.

## Mentioned in this report

- Vulnerabilities: CVE-2026-15305, CVE-2026-19418

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1036

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/815a299e-5ccb-5569-99f3-175233ebf7fa/typo3-patches-security-bypass-flaws.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup