TYPO3 Core 14.2.0 Information Disclosure Vulnerability
Summary
CERT-Bund issued a security advisory warning of a high-severity information disclosure vulnerability in TYPO3 Core 14.2.0. The vulnerability carries a CVSS Base Score of 7.4 (high) and a Temporal Score of 6.4 (medium), and can be exploited remotely by anonymous attackers. Mitigation measures are available and organisations running affected installations should apply them promptly.
“Ein entfernter, anonymer Angreifer kann eine Schwachstelle in TYPO3 Core ausnutzen, um Informationen offenzulegen.”
Organisations running TYPO3 Core should verify their installations against version 14.2.0. Given the CVSS 7.4 score and confirmed remote exploitability, security teams should treat this as a priority patch — the combination of no authentication requirement and information disclosure risk creates a clear attack surface. Even if a full patch is not yet available, network-level restrictions on access to TYPO3 administrative interfaces can reduce exposure in the interim.
What changed
CERT-Bund disclosed a high-severity information disclosure vulnerability in TYPO3 Core version 14.2.0. The flaw has a CVSS Base Score of 7.4 and can be exploited remotely by an anonymous attacker without authentication.
Organisations running TYPO3 Core installations should verify whether they are running the affected version 14.2.0, apply any available patches or workarounds, and monitor for indicators of exploitation. Given the remote exploitability and high CVSS score, this vulnerability should be prioritised in patch management workflows.
What to do next
- Apply available mitigations
Archived snapshot
Apr 21, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
[WID-SEC-2026-1191] TYPO3 Core: Schwachstelle ermöglicht Offenlegung von Informationen CVSS Base Score 7.4 (hoch) CVSS Temporal Score 6.4 (mittel) Remoteangriff ja Datum 20.04.2026 Stand 21.04.2026 Mitigation ja
Betroffene Systeme
Betriebssystem
- Linux
- UNIX
- Windows
Produktbeschreibung
TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.
Produkte
20.04.2026
- TYPO3 Core 14.2.0
Angriff
Angriff
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in TYPO3 Core ausnutzen, um Informationen offenzulegen. CVE Informationen Versionshistorie Feedback zum Advisory geben
Related changes
Get daily alerts for CERT-Bund Security Advisories
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from BSI / CERT-Bund.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when CERT-Bund Security Advisories publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.