CVE-2026-77131

5.3 mediumEPSS 0.2%

Medium (5.3). EPSS 0.2% chance of exploitation in the next 30 days.

When OpenSSL is unavailable on the server, the extension transmits TYPO3 system information in cleartext instead of encrypting it. Exploitation requires the attacker to already be in control of the SYSSY project's API key.

Severity

CVSS 4.0

5.3 medium

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 15% of CVEs (scores of 2026-10-31)
CWE: CWE-319
Published: 2026-08-25
Modified: 2026-08-26
Record from: the NVD, synced 2026-10-19

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-015

Check your stack JSON