GHSA-qffc-gwpp-m2xr
XML External Entity (XXE) Processing in TYPO3 Core
All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.
What each source reports
GitHub AdvisoriesNo score
XML External Entity (XXE) Processing in TYPO3 Core
All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.
- Record
GHSA-qffc-gwpp-m2xr- Updated
- 2026-11-02
OSVNo score
XML External Entity (XXE) Processing in TYPO3 Core
All XML processing within the TYPO3 CMS are vulnerable to XEE processing. This can lead to load internal and/or external (file) content within an XML structure. Furthermore it is possible to inject arbitrary files for an XML Denial of Service attack. For more information on that topic see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing.
- Record
GHSA-qffc-gwpp-m2xr- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 6.2.0 up to 6.2.19 | 6.2.19 |
typo3/cmsPackagist | 7.6.0 up to 7.6.4 | 7.6.4 |
typo3/cmsPackagist | 6.2.0 up to 6.2.19, plus listed versions 6.2.16.2.106.2.10-rc16.2.116.2.12 Show 14 moreShow less6.2.136.2.146.2.156.2.166.2.176.2.186.2.26.2.36.2.46.2.56.2.66.2.76.2.86.2.9 | 6.2.19 |
typo3/cmsPackagist | 7.6.0 up to 7.6.4, plus listed versions 7.6.17.6.27.6.3 | 7.6.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-qffc-gwpp-m2xr is a vulnerability with no CVSS score yet in typo3/cms, published June 4, 2024. No source lists public exploit code. Fixed in typo3/cms 6.2.19.