Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

typo3-cms/core

              main @ db890be
            

Fixes

CVEs

CRITICAL

Peak severity

44.4%

Coverage

Highlights

Auth Bypass: 3 prior fixes. Scrutinize any change in this area.

CMS: most-fixed (2 issues). Treat as high-risk during review.

6 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Backend utility and data handlers can bypass modification checks, allowing users to move records or restore/undelete pages and tables they lack permission to edit.

Path Traversal: Insufficiencies in string-prefix and backslash verification allow file path validation bypasses on adjacent sibling directories or inside zip archives.

PHP Object Injection: Unsafe deserialization from unauthenticated sources can trigger PHP Object Injection, requiring robust HMAC verification and reflective denylists.