Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
TYPO3 CMS versions 11.0.0 up to 11.5.0 (packages typo3/cms-core and typo3/cms) accept a forged HTTP Host header, which is used for generating absolute URLs during frontend rendering. A remote attacker can send requests with an arbitrary Host value and affect the generated links, with low integrity impact. Upgrade to TYPO3 version 11.5.0. The trustedHostsPattern setting can also be used to restrict accepted host names.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 4.8 | Medium | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.012, the 68th percentile, on 6 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 14:25 UTC First seen by agentprime
- 31 Oct 2026, 14:25 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-m2jh-fxw4-gphm
- OSV: GHSA-m2jh-fxw4-gphm
- github.com/TYPO3/typo3/security/advisories/GHSA-m2jh-fxw4-gphm
- nvd.nist.gov/vuln/detail/CVE-2014-3941
- nvd.nist.gov/vuln/detail/CVE-2021-41114
- github.com/TYPO3/typo3/commit/5cbff85506cebe343e5ae59228977547cf8e3cf4
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41114.yaml
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41114.yaml
- github.com/TYPO3/typo3
- typo3.org/security/advisory/typo3-core-sa-2021-015