High
Security advisory
Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-5091
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:13 UTC · Revision 1
Source evidence
Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.
osv:CVE-2016-5091
Complete source record
{
"id": "5f4673da6507aae756c66b6c97d1cb3bb93505913273dcf14b9927042a875b3b",
"url": "https://osv.dev/vulnerability/CVE-2016-5091",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-5091",
"summary": "Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.",
"evidence": "osv:CVE-2016-5091",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-5091",
"aliases": [
"CVE-2016-5091",
"GHSA-jxg5-35fj-ccwf"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/TYPO3/typo3",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "35858f8f3ca041b40d21e917365b182f28ff88c4"
},
{
"introduced": "583c888de32e077111951cced1a33571516cb5d3"
},
{
"last_affected": "0833baed1fedfc868c64330fc8dc348b8c07ce02"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "6.2.23"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.0.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.2"
},
{
"last_affected": "7.0.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.1.0"
},
{
"last_affected": "7.1.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.2.0"
},
{
"last_affected": "7.2.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.0"
},
{
"last_affected": "7.3.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.3.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.1"
},
{
"last_affected": "7.3.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.4.0"
},
{
"last_affected": "7.4.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.5.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.5.0"
},
{
"last_affected": "7.5.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.0"
},
{
"last_affected": "7.6.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.1"
},
{
"last_affected": "7.6.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.2"
},
{
"last_affected": "7.6.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.3"
},
{
"last_affected": "7.6.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.4"
},
{
"last_affected": "7.6.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.5"
},
{
"last_affected": "7.6.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.6"
},
{
"last_affected": "7.6.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.7"
},
{
"last_affected": "7.6.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.8"
},
{
"last_affected": "7.6.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.1.1"
},
{
"last_affected": "8.1.1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.0.0",
"7.0.2",
"7.1.0",
"7.2.0",
"7.3.0",
"7.3.1",
"7.4.0",
"7.5.0",
"7.6.0",
"7.6.1",
"7.6.2",
"7.6.3",
"7.6.4",
"7.6.5",
"7.6.6",
"7.6.7",
"7.6.8",
"8.1.1",
"TYPO3_8-1-1",
"TYPO3_8-1-0",
"8.1.0",
"TYPO3_6-2-23",
"6.2.23",
"TYPO3_6-2-22",
"6.2.22",
"TYPO3_6-2-21",
"6.2.21",
"TYPO3_6-2-20",
"6.2.20",
"TYPO3_8-0-0",
"8.0.0",
"TYPO3_6-2-19",
"6.2.19",
"TYPO3_6-2-18",
"6.2.18",
"TYPO3_7-6-2",
"TYPO3_6-2-17",
"6.2.17",
"TYPO3_7-6-1",
"TYPO3_6-2-16",
"6.2.16",
"TYPO3_7-6-0",
"TYPO3_7-5-0",
"TYPO3_6-2-15",
"6.2.15",
"TYPO3_7-4-0",
"TYPO3_6-2-14",
"6.2.14",
"TYPO3_7-3-0",
"TYPO3_6-2-13",
"6.2.13",
"TYPO3_7-2-0",
"TYPO3_6-2-12",
"6.2.12",
"TYPO3_6-2-11",
"6.2.11",
"TYPO3_6-2-10",
"6.2.10",
"TYPO3_7-1-0",
"TYPO3_6-2-10rc1",
"6.2.10-rc1",
"TYPO3_6-2-9",
"6.2.9",
"TYPO3_6-2-8",
"6.2.8",
"TYPO3_7-0-0",
"TYPO3_6-2-7",
"6.2.7",
"TYPO3_6-2-6",
"6.2.6",
"TYPO3_6-2-5",
"6.2.5",
"TYPO3_6-2-4",
"6.2.4",
"TYPO3_6-2-3",
"6.2.3",
"TYPO3_6-2-2",
"6.2.2",
"TYPO3_6-2-1",
"6.2.1",
"TYPO3_6-2-0",
"6.2.0",
"TYPO3_6-2-0rc2",
"TYPO3_6-2-0rc1",
"TYPO3_6-2-0beta7",
"TYPO3_6-2-0beta6",
"TYPO3_6-2-0beta5",
"TYPO3_6-2-0beta4",
"TYPO3_6-2-0beta3",
"TYPO3_6-2-0beta2",
"TYPO3_6-2-0beta1",
"TYPO3_6-2-0alpha3",
"TYPO3_6-2-0alpha2",
"TYPO3_6-2-0alpha1",
"TYPO3_6-1-0rc1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5091.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/benjaminkott/bootstrap_package",
"type": "GIT",
"events": [
{
"introduced": "2bc505c5e22c84371390d6b9969da0e437094e93"
},
{
"last_affected": "fe9f029bdc791fab9ac1c6fbf5f721522b961a10"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:typo3:typo3:7.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.0.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.2"
},
{
"last_affected": "7.0.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.1.0"
},
{
"last_affected": "7.1.0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.0.0",
"7.0.2",
"7.1.0",
"v7.0.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5091.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/typo3/typo3",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "35858f8f3ca041b40d21e917365b182f28ff88c4"
},
{
"introduced": "583c888de32e077111951cced1a33571516cb5d3"
},
{
"last_affected": "0833baed1fedfc868c64330fc8dc348b8c07ce02"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "6.2.23"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.0.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.0"
},
{
"last_affected": "7.0.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.0.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.0.2"
},
{
"last_affected": "7.0.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.1.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.1.0"
},
{
"last_affected": "7.1.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.2.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.2.0"
},
{
"last_affected": "7.2.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.0"
},
{
"last_affected": "7.3.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.3.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.3.1"
},
{
"last_affected": "7.3.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.4.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.4.0"
},
{
"last_affected": "7.4.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.5.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.5.0"
},
{
"last_affected": "7.5.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.0"
},
{
"last_affected": "7.6.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.1"
},
{
"last_affected": "7.6.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.2"
},
{
"last_affected": "7.6.2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.3"
},
{
"last_affected": "7.6.3"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.4"
},
{
"last_affected": "7.6.4"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.5"
},
{
"last_affected": "7.6.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.6"
},
{
"last_affected": "7.6.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.7"
},
{
"last_affected": "7.6.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*",
"range": [
{
"introduced": "7.6.8"
},
{
"last_affected": "7.6.8"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "8.1.1"
},
{
"last_affected": "8.1.1"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"7.0.0",
"7.0.2",
"7.1.0",
"7.2.0",
"7.3.0",
"7.3.1",
"7.4.0",
"7.5.0",
"7.6.0",
"7.6.1",
"7.6.2",
"7.6.3",
"7.6.4",
"7.6.5",
"7.6.6",
"7.6.7",
"7.6.8",
"8.1.1",
"TYPO3_8-1-1",
"TYPO3_8-1-0",
"8.1.0",
"TYPO3_6-2-23",
"6.2.23",
"TYPO3_6-2-22",
"6.2.22",
"TYPO3_6-2-21",
"6.2.21",
"TYPO3_6-2-20",
"6.2.20",
"TYPO3_8-0-0",
"8.0.0",
"TYPO3_6-2-19",
"6.2.19",
"TYPO3_6-2-18",
"6.2.18",
"TYPO3_7-6-2",
"TYPO3_6-2-17",
"6.2.17",
"TYPO3_7-6-1",
"TYPO3_6-2-16",
"6.2.16",
"TYPO3_7-6-0",
"TYPO3_7-5-0",
"TYPO3_6-2-15",
"6.2.15",
"TYPO3_7-4-0",
"TYPO3_6-2-14",
"6.2.14",
"TYPO3_7-3-0",
"TYPO3_6-2-13",
"6.2.13",
"TYPO3_7-2-0",
"TYPO3_6-2-12",
"6.2.12",
"TYPO3_6-2-11",
"6.2.11",
"TYPO3_6-2-10",
"6.2.10",
"TYPO3_7-1-0",
"TYPO3_6-2-10rc1",
"6.2.10-rc1",
"TYPO3_6-2-9",
"6.2.9",
"TYPO3_6-2-8",
"6.2.8",
"TYPO3_7-0-0",
"TYPO3_6-2-7",
"6.2.7",
"TYPO3_6-2-6",
"6.2.6",
"TYPO3_6-2-5",
"6.2.5",
"TYPO3_6-2-4",
"6.2.4",
"TYPO3_6-2-3",
"6.2.3",
"TYPO3_6-2-2",
"6.2.2",
"TYPO3_6-2-1",
"6.2.1",
"TYPO3_6-2-0",
"6.2.0",
"TYPO3_6-2-0rc2",
"TYPO3_6-2-0rc1",
"TYPO3_6-2-0beta7",
"TYPO3_6-2-0beta6",
"TYPO3_6-2-0beta5",
"TYPO3_6-2-0beta4",
"TYPO3_6-2-0beta3",
"TYPO3_6-2-0beta2",
"TYPO3_6-2-0beta1",
"TYPO3_6-2-0alpha3",
"TYPO3_6-2-0alpha2",
"TYPO3_6-2-0alpha1",
"TYPO3_6-1-0rc1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-5091.json"
}
}
],
"modified": "2026-10-24T10:31:04.434541850Z",
"provider": "osv",
"references": [
"https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2016-013/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*"
],
"vendor_product": "typo3:typo3",
"extracted_events": [
{
"range": [
{
"last_affected": "6.2.23"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:a:typo3:typo3:7.2.0:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.4.0:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.5.0:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*",
"cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*"
],
"vendor_product": "typo3:typo3",
"extracted_events": [
{
"range": [
{
"introduced": "7.2.0"
},
{
"last_affected": "7.2.0"
},
{
"introduced": "7.3.0"
},
{
"last_affected": "7.3.0"
},
{
"introduced": "7.3.1"
},
{
"last_affected": "7.3.1"
},
{
"introduced": "7.4.0"
},
{
"last_affected": "7.4.0"
},
{
"introduced": "7.5.0"
},
{
"last_affected": "7.5.0"
},
{
"introduced": "7.6.0"
},
{
"last_affected": "7.6.0"
},
{
"introduced": "7.6.1"
},
{
"last_affected": "7.6.1"
},
{
"introduced": "7.6.2"
},
{
"last_affected": "7.6.2"
},
{
"introduced": "7.6.3"
},
{
"last_affected": "7.6.3"
},
{
"introduced": "7.6.4"
},
{
"last_affected": "7.6.4"
},
{
"introduced": "7.6.5"
},
{
"last_affected": "7.6.5"
},
{
"introduced": "7.6.6"
},
{
"last_affected": "7.6.6"
},
{
"introduced": "7.6.7"
},
{
"last_affected": "7.6.7"
},
{
"introduced": "7.6.8"
},
{
"last_affected": "7.6.8"
},
{
"introduced": "8.1.1"
},
{
"last_affected": "8.1.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-5091",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 440523,
"published_at": "2017-01-23T21:59:01.61+00:00"
}