GHSA-6487-3qvg-8px9

TYPO3 Information Disclosure in Install Tool

5.3 MediumFix available

The Install Tool exposes the current TYPO3 version number to non-authenticated users.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

What each source reports

GitHub Advisories Score used5.3

TYPO3 Information Disclosure in Install Tool

The Install Tool exposes the current TYPO3 version number to non-authenticated users.

Record: GHSA-6487-3qvg-8px9
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV5.3

TYPO3 Information Disclosure in Install Tool

The Install Tool exposes the current TYPO3 version number to non-authenticated users.

Record: GHSA-6487-3qvg-8px9
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

Affected packages

Affected packages
Package	Affected	Fixed
`typo3/cms` Packagist	7.0.0 up to 7.6.32	7.6.32
`typo3/cms` Packagist	8.0.0 up to 8.7.21	8.7.21
`typo3/cms` Packagist	9.0.0 up to 9.5.2	9.5.2
`typo3/cms` Packagist	7.0.0 up to 7.6.32, plus listed versions 7.0.17.0.27.1.07.2.07.3.0 Show 35 moreShow less 7.3.17.4.07.5.07.6.07.6.17.6.107.6.117.6.127.6.137.6.147.6.157.6.167.6.177.6.187.6.197.6.27.6.37.6.47.6.57.6.67.6.77.6.87.6.9v7.6.20v7.6.21v7.6.22v7.6.23v7.6.24v7.6.25v7.6.26v7.6.27v7.6.28v7.6.29v7.6.30v7.6.31	7.6.32
`typo3/cms` Packagist	8.0.0 up to 8.7.21, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 30 moreShow less 8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9	8.7.21
`typo3/cms` Packagist	9.0.0 up to 9.5.2, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 6 moreShow less v9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1	9.5.2

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	GitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-6487-3qvg-8px9 is a medium vulnerability (CVSS 5.3) in typo3/cms, published June 7, 2024. No source lists public exploit code. Fixed in typo3/cms 7.6.32.

Attack profile

How easy it is to exploit

What an attacker can affect

What each source reports

Affected packages

History

In short

References