Vulnerabilities

The click tracking middleware accepts an arbitrary target URL and redirects to it.

The click tracking middleware does not validate the authentication code of a recipient if the code is omitted.

Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module.

Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group.

Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host.

The HTML content of mails and tracked URLs are rendered unescaped in the backend module.

The actions linked in the emails of the extension (e.g.

The extension no longer applied its access protection to files in file storages that use a non-default relative base path.

The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page.

The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and used them in a database query without validation.

The JSON import of the cookie consent configuration did not respect the backend user's permissions.

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself.

The backend module does not check whether a backend user has access to the requested site.

The extension provides a public proxy endpoint that fetches a URL on behalf of the visitor.

The download link for files uploaded through a form relied on a token that could be predicted.

Values entered by visitors were placed into the HTML summary email without being escaped.

The file search of the extension builds its database conditions by wrapping the search term in quotes itself.

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it.

The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider.

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record.

In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the editor plugin can contact the OpenAI service directly from the browser.

The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget.

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination.

An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3.

An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3.