-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability occurs in functions handling form configuration merging and TypoScript resolution. Both functions were vulnerable because they processed user-controlled YAML data (form definitions) as executable TypoScript before proper separation of user input from internal configuration. The commit fixes show they were modified to resolve TypoScript in the override arrays BEFORE merging, rather than processing the merged result. This indicates the original implementation allowed user-submitted YAML containing TypoScript instructions (like _typoScriptNodeValue) to be evaluated as PHP code through the TypoScriptService::resolvePossibleTypoScriptConfiguration method.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 8.0.0, < 8.7.49 | 8.7.49 |
| typo3/cms-core | composer | >= 9.0.0, < 9.5.38 | 9.5.38 |
| typo3/cms-core | composer | >= 10.0.0, < 10.4.33 | 10.4.33 |
| typo3/cms-core | composer | >= 11.0.0, < 11.5.20 | 11.5.20 |
| typo3/cms-core | composer | >= 12.0.0, < 12.1.1 | 12.1.1 |
| typo3/cms | composer | >= 10.0.0, < 10.4.33 | 10.4.33 |
| typo3/cms | composer | >= 11.0.0, < 11.5.20 | 11.5.20 |
| typo3/cms | composer | >= 12.0.0, < 12.1.1 | 12.1.1 |
PHPPHPOngoing coverage of React2Shell