TYPO3 Extensions Multiple Vulnerabilities

CERT-Bund Security Advisories

Published March 16th, 2026

Detected March 17th, 2026

Summary

CERT-Bund has issued a security advisory for multiple vulnerabilities in TYPO3 Extensions, including Mailqueue and Redirect Tab. The vulnerabilities have a CVSS base score of 7.5 and can allow for remote code execution or information disclosure.

View original document View source feed page

What changed

CERT-Bund has released a security advisory (WID-SEC-2026-0753) detailing multiple vulnerabilities in various TYPO3 extensions, including Mailqueue and Redirect Tab. These vulnerabilities, with a CVSS base score of 7.5, can be exploited by authenticated local or remote attackers to execute arbitrary code, disclose sensitive information, or bypass security measures. The advisory lists specific affected versions of the extensions and notes that mitigation is available.

Organizations using TYPO3 with the affected extensions must update to patched versions immediately to prevent exploitation. Failure to do so could result in significant data breaches, system compromise, and potential operational disruption. While no specific compliance deadline is mentioned, prompt patching is critical for maintaining system security and data integrity.

What to do next

Update TYPO3 extensions Mailqueue and Redirect Tab to versions not affected by the vulnerabilities.
Review system logs for any signs of exploitation.
Implement mitigation strategies as recommended by CERT-Bund.

Source document (simplified)

[WID-SEC-2026-0753] TYPO3 Extensions: Mehrere Schwachstellen CVSS Base Score 7.5 (hoch) CVSS Temporal Score 6.9 (mittel) Remoteangriff ja Datum 16.03.2026 Stand 17.03.2026 Mitigation ja

Betroffene Systeme

Betriebssystem

Sonstiges
UNIX
Windows

Produktbeschreibung

TYPO3 ist ein freies Content-Management-System, basierend auf der Scriptsprache PHP und einer SQL-Datenbank. Über zahlreiche Extensions kann der Funktionsumfang der Core-Installation individuell erweitert werden.

Produkte

16.03.2026
- TYPO3 Extension Mailqueue <0.5.2

TYPO3 Extension Mailqueue <0.4.5
TYPO3 Extension Redirect Tab <4.0.5
TYPO3 Extension Redirect Tab <3.1.7
TYPO3 Extension Redirect Tab <2.1.2
TYPO3 Extension E-Mail MFA Provider

Angriff

Ein lokaler, oder ein enfernter authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen. CVE Informationen Versionshistorie Feedback zum Advisory geben