CVE-2026-49740

Packagist/typo3/cms-core CVE-2026-49740: medium, EPSS 0.59%

TYPO3 CMS has Insecure Deserialization via Core API

Action: Upgrade typo3/cms-core to 10.4.57 or later.

composer require typo3/cms-core:10.4.57

composer require typo3/cms-core:11.5.51

composer require typo3/cms-core:12.4.46

composer require typo3/cms-core:13.4.31

composer require typo3/cms-core:14.3.3

Affected

Fixed versions

Sources

• osv: GHSA-c78m-c52x-jgwp
• https://github.com/TYPO3/typo3/security/advisories/GHSA-c78m-c52x-jgwp
• https://nvd.nist.gov/vuln/detail/CVE-2026-49740
• https://github.com/TYPO3/typo3/commit/48bcf24f31f52cc0b43d3bea4984634bd2cf85c7
• https://github.com/TYPO3/typo3/commit/87cd7c5b710c44d3606fed277b040a75dc6a9c02
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49740.yaml
• https://github.com/TYPO3/typo3
• https://typo3.org/security/advisory/typo3-core-sa-2026-018

CVE-2026-49740 · published 2026-06-12T19:09:26Z · modified 2026-09-10T03:51:08.473143340Z · JSON