Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
TYPO3 typo3/cms-core versions 9.0.0 up to but not including 9.5.6 are affected. Login failures are logged at the default stream with log level "warning" and include plain-text user credentials, so anyone with access to those logs can read them. Upgrade typo3/cms-core to 9.5.6 or later. The source gives few details about who can read the logs.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 5.3 | Medium | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:28 UTC First seen by agentprime
- 31 Oct 2026, 14:28 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-wj85-rg5g-v8jm
- OSV: GHSA-wj85-rg5g-v8jm
- github.com/TYPO3-CMS/core/commit/ac0565b7a539398a07adf21f04f85cd2574817d2
- github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-05-07-5.yaml
- github.com/TYPO3-CMS/core
- typo3.org/security/advisory/typo3-core-sa-2019-010