On 9 June 2026, the TYPO3 team released security updates for several version branches. These include TYPO3 13.4.31 and TYPO3 12.4.46 ELTS. Both releases contain further bug fixes in addition to security fixes. Release notes for TYPO3 13 and TYPO3 12
Which areas are affected
The fixed vulnerabilities concern, among other things, permission checks in file management and the processing of form definitions. With certain access options, users could carry out actions outside their intended rights. In the form system, an escalation of permissions was also possible under certain conditions.
The TYPO3 Security Team rates these two vulnerabilities as high. Which versions are affected and which access rights an attacker needs is stated in the respective security advisory. Security advisory on file management and on the form system
Preparing the update promptly
We recommend updating affected installations promptly. First, the installed version, the extensions used and the relevant security advisories should be checked.
Before installing, a current backup and tests in a separate environment are part of it. Which functions need to be checked depends on the website – for example login, forms, file management and custom interfaces.
The implementation and timing are agreed as part of the respective agreed support.
What to consider with TYPO3 12
Free community support for TYPO3 12 ended on 30 April 2026. Version 12.4.46 is therefore provided in the paid Extended Long Term Support, ELTS for short. Support notice on TYPO3 12
Anyone who continues to operate TYPO3 12 should clarify how the supply of security updates is ensured. The official ELTS can be an interim solution for this, while a switch to a regularly supported major version is being prepared. However, planning an upgrade does not replace protection until the actual switch.
The security fixes described here are not included in the last freely available version.
If you would like to clarify your version and support status, we support you with the technical assessment and planning of the next steps – as a TYPO3 upgrade or as part of maintenance and support.
Addendum of 8 September 2026: Further security updates have since been released. A later state is described in our article on the September security releases.
