UpHeron
All vulnerabilities

Servers and applications

CVE-2020-11067

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components, this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.

Severity
High 8.8
Published
14 May 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
TYPO3Servers and applications · cpe:a:typo3:typo3
  • From 9.0.0 up to 9.5.16
  • From 10.0.0 up to 10.4.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-11067
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-11067