CVE-2026-47351

published 2026-06-09

CVE-2026-47351: Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather…

Priority P4 33 medium 5.3 CVSS 4.0

AV N AC L AT N PR L UI N VC L VI N VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather information about records and files they were not authorized to view. This issue affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.

Affected

12 ranges

Vendor	Product	Version range	Fixed in
typo3	cms-backend	>= 0 < 10.4.57	10.4.57
typo3	cms-backend	>= 11.0.0 < 11.5.51	11.5.51
typo3	cms-backend	>= 12.0.0 < 12.4.46	12.4.46
typo3	cms-backend	>= 13.0.0 < 13.4.31	13.4.31
typo3	cms-backend	>= 14.0.0 < 14.3.3	14.3.3
typo3	cms-core	>= 0 < 10.4.57	10.4.57
typo3	cms-core	>= 11.0.0 < 11.5.51	11.5.51
typo3	cms-core	>= 12.0.0 < 12.4.46	12.4.46
typo3	cms-core	>= 13.0.0 < 13.4.31	13.4.31
typo3	cms-core	>= 14.0.0 < 14.3.3	14.3.3
typo3	typo3_cms	>= 10.4.0 < 13.4.31	13.4.31
typo3	typo3_cms	>= 14.0.0 < 14.3.3	14.3.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200 CWE-862