TYPO3 CMS Open Redirect Vulnerability Advisory (CVE-2026-47347)

TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS Vulnerability Overview Vulnerability Type: Open Redirect Severity: Medium Release Date: June 9, 2026 Affected Component: Core Utilities (ext:core) Description: Applications that use are vulnerable to open redirect attacks if the URL remains usable after passing the aforementioned sanitization check. This allows attackers to redirect users to external content and execute phishing attacks. Scope of Impact Affected Versions: - 10.0.0-10.4.56 - 11.0.0-11.5.50 - 12.0.0-12.4.45 - 13.0.0-13.4.30 - 14.0.0-14.3.2 Remediation Recommendation: Upgrade to the following versions to resolve the issue: - 10.4.57 LTS - 11.5.51 LTS - 12.4.46 LTS - 13.4.31 LTS - 14.3.3 LTS References CVE: CVE-2026-47347 CWE: CWE-601 CVSS: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:R/VC:N/VI:N/VA:N/SC:N/SH:S/SA:N General Advice Follow the recommendations outlined in the TYPO3 Security Guide. Subscribe to the TYPO3 announcement mailing list. General Notes All security-related code changes are marked to facilitate easy identification within the review system. Author Information Author: Oliver Hader Position: Core Developer at TYPO3 GmbH, Hof, Germany Bio: Oliver has been using TYPO3 since 2005 and is fascinated by the product and its ecosystem. Since 2007, he has been a member of the TYPO3 Core Team. He obtained a graduate master's degree in Internet Network Science in 2014 and now researches advanced network technology topics, particularly those relevant to TYPO3.

Goal Reached Thanks to every supporter — we hit 100%!

TYPO3 CMS Open Redirect Vulnerability Advisory (CVE-2026-47347)