Dear TYPO3 users,
several vulnerabilities have been found in the following third party TYPO3 extensions:
- "FAL Protect" (fal_protect)
- "sgalinski Cookie Consent" (sg_cookie_optin)
- "Accessible Form Captcha" (bw_captcha)
- "Analytics" (analytics)
- "Kitodo.Presentation" (dlf)
- "TYPO3 Fluid-Form by coding.ms" (fluid_form)
- "File manager" (ameos_filemanager)
- "TYPO3 AI Integration Extension" (ns_t3ai)
- "TYPO3 Shop by coding.ms" (shop)
For further information on the issues, please read the related advisories
TYPO3-EXT-SA-2026-028, TYPO3-EXT-SA-2026-029, TYPO3-EXT-SA-2026-030,
TYPO3-EXT-SA-2026-031, TYPO3-EXT-SA-2026-032, TYPO3-EXT-SA-2026-033,
TYPO3-EXT-SA-2026-034, TYPO3-EXT-SA-2026-035, and TYPO3-EXT-SA-2026-036
which were published today:
TYPO3-EXT-SA-2026-028: Broken Access Control in extension "FAL Protect" (fal_protect)
TYPO3-EXT-SA-2026-029: Multiple vulnerabilities in extension "sgalinski Cookie Consent" (sg_cookie_optin)
https://news.typo3.com/security/advisory/typo3-ext-sa-2026-029
TYPO3-EXT-SA-2026-030: Captcha Bypass in extension "Accessible Form Captcha" (bw_captcha)
TYPO3-EXT-SA-2026-031: Multiple vulnerabilities in extension "Analytics" (analytics)
https://news.typo3.com/security/advisory/typo3-ext-sa-2026-031
TYPO3-EXT-SA-2026-032: Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf)
TYPO3-EXT-SA-2026-033: Multiple vulnerabilities in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033
TYPO3-EXT-SA-2026-034: SQL Injection in extension "File manager" (ameos_filemanager)
TYPO3-EXT-SA-2026-035: Multiple vulnerabilities in extension "TYPO3 AI Integration Extension" (ns_t3ai)
TYPO3-EXT-SA-2026-036: Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
https://news.typo3.com/security/advisory/typo3-ext-sa-2026-036
In general the TYPO3 Security Team recommends to read the following pages:
The TYPO3 Security Guide:
https://docs.news.typo3.com/typo3cms/CoreApiReference/Security/Index.html
See all TYPO3 security advisories:
https://typo3.org/help/security-advisories
Best regards,
Torben Hansen
Member of the TYPO3 Security Team