CVE-2019-11832
TYPO3 Image Processing susceptible to Code Execution
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
- Record
CVE-2019-11832- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
- Record
CVE-2019-11832- Updated
- 2026-11-02
EUVDEUVD-2022-2250 No score
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
- Record
EUVD-2022-2250- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3w4h-r27h-4r2w
TYPO3 Image Processing susceptible to Code Execution
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
For a successful exploit, the GhostScript binary gs must be available on the server system.
- Record
GHSA-3w4h-r27h-4r2w- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
OSV
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
- Record
CVE-2019-11832- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-3w4h-r27h-4r2w
TYPO3 Image Processing susceptible to Code Execution
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code execution because it does not properly configure the applications used for image processing, as demonstrated by ImageMagick or GraphicsMagick.
For a successful exploit, the GhostScript binary gs must be available on the server system.
- Record
GHSA-3w4h-r27h-4r2w- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-94
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
8.0.0 up to 8.7.25 | 8.7.25 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.6 | 9.5.6 |
typo3/cmsPackagist |
8.0.0 up to 8.7.25 | 8.7.25 |
typo3/cmsPackagist |
9.0.0 up to 9.5.6 | 9.5.6 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.25, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 13 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.7v8.7.8v8.7.9 |
8.7.25 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.6, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 10 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3v9.5.4v9.5.5 |
9.5.6 |
typo3/cmsPackagist |
8.0.0 up to 8.7.25, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 34 moreShow less8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 |
8.7.25 |
typo3/cmsPackagist |
9.0.0 up to 9.5.6, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 10 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3v9.5.4v9.5.5 |
9.5.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-11832 is a high vulnerability (CVSS 7.5) in Typo3, published May 9, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.92%, the 90th percentile. Fixed in typo3/cms-core 8.7.25.
References
typo3.org/security/advisory/typo3-core-sa-2019-012
securityfocus.com/bid/108305
nvd.nist.gov/vuln/detail/CVE-2019-11832
github.com/github/advisory-database/pull/3530
Show 5 moreShow less