What’s Vulnerable › Vulnerabilities

CVE-2024-22188

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-05 · updated 2026-06-17
• Weakness: CWE-94

Description

TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.

Affected products

• typo3: from 8.0.0 before 8.7.57; from 9.0.0 before 9.5.46; from 10.0.0 before 10.4.43; from 11.0.0 before 11.5.35; from 12.0.0 before 12.4.11; 13.0.0 — fixed in 10.4.43, 11.5.35, 12.4.11, 8.7.57, 9.5.46

How to fix

Upgrade to a fixed version: typo3 10.4.43, 11.5.35, 12.4.11, 8.7.57. Check the vendor advisory for mitigations.

References

• https://github.com/TYPO3/typo3/security/advisories/GHSA-5w2h-59j3-8x5w
• https://typo3.org/security/advisory/typo3-core-sa-2024-002
• https://github.com/TYPO3/typo3/security/advisories/GHSA-5w2h-59j3-8x5w
• https://typo3.org/help/security-advisories
• https://typo3.org/security/advisory/typo3-core-sa-2024-002

Get alerted when CVE-2024-22188 or the next vulnerability affects your stack