TYPO3

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical, CVSS v4.0 >= 9.0 (TYPO3 CMS core) │ EUR 600 │ EUR 750 High, CVSS v4.0 >= 7.0 │ EUR 300 │ EUR 375 Medium, CVSS v4.0 >= 4.0 │ EUR 150 │ EUR 188 Low, CVSS v4.0 < 4.0 │ EUR 50 │ EUR 63 Submit a vulnerability CVE history 17 Last 12 months 127 Lifetime XSS 35 % Access control 25 % Info disclosure 20 % Injection 15 % Latest advisories Loading the feed Overview TYPO3 is the dominant enterprise CMS in the German-speaking market and a common choice for European public-sector, university and large-corporate sites: around 0.4% of all websites and 0.5% of CMS market share, small globally but concentrated in a compliance-heavy segment where individual installations are very large and essentially all self-hosted. A defect in the core reaches every one of those installs on the next Composer update, which is why the Association runs its own bounty rather than relying on goodwill. It pays in euro on a CVSS v4.0 matrix: up to 600 EUR for a Critical against the core, down to 50 EUR at Low, by SEPA transfer or PayPal, out of a budget the Association grants annually and which is therefore genuinely exhaustible. Note what the same matrix no longer pays for: third-party extensions, historically the larger part of TYPO3's attack surface, dropped to zero across every severity on 31 May 2026. sorona.xyz adds 1.25x on top of whatever TYPO3 awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. In scope TYPO3 CMS core, in the program's own words "all stable versions that are maintained for the TYPO3 community at the time of a vulnerability report are covered". That is the headline declaration and the only reward row that reaches 600 EUR The backend in full: the user, group and permission model, login and session handling, the install tool, and every module an authenticated editor or administrator can reach Frontend rendering, covering TypoScript evaluation, Fluid template rendering, the content elements the core ships, and the routing that resolves a page request The database abstraction layer and the query building that core modules and extensions alike go through The file abstraction layer, its storage drivers, upload handling and the processed-file pipeline The core components that accept visitor input, including the form framework, link handling and redirect handling Workspaces, versioning and the content staging model, along with the frontend and backend authentication that gate them The extension manager, scheduler and the other core system extensions shipped in a standard distribution TYPO3-operated infrastructure as a separate and lower-paying row: typo3.org, extensions.typo3.org, my.typo3.org and the Association's ldap, git, review and docs services, at 300 EUR for a Critical, 150 at High, 100 at Medium and nothing at Low Out of scope Third-party extensions from the TER: the extension column pays zero at every severity, because "financial rewards for extension vulnerability reports end on 31 May 2026". This is the single largest piece of TYPO3's attack surface and it no longer pays Development-only branches and unreleased code, since the scope is limited to released, community-maintained stable versions Versions that have fallen out of community maintenance at the time you report them Low-severity infrastructure findings, where the matrix's Infrastructure row leaves the Low cell empty Reports from active TYPO3 Association members, who are excluded from rewards by the program's own terms Bounty begging and pressure of any kind, which the Security Team states plainly it will ignore Most-valued findings Stored cross-site scripting that survives into the backend and fires against an administrator. XSS is 35% of this project's advisory mix, the largest class by a distance, and this is the shortest path from an editor account to full site control Backend authorization bypass that lets a low-privilege editor reach an administrator module, another site's records or the install tool. Access control runs at 25% of the mix, and this is the 600 EUR Critical shape on a CMS whose customers are governments and universities Authenticated remote code execution through the file abstraction layer, extension installation or TypoScript evaluation, where a content role turns into code on the server Unauthenticated information disclosure that exposes configuration, credentials or unpublished content to an anonymous visitor of a default install, a class carrying 20% of the record SQL injection through the database abstraction layer from a value an anonymous frontend request controls, the highest-CVSS shape in the 15% of advisories that are injection Any of the above shown against a stock, currently maintained core release rather than against a configuration the reporter had to weaken first Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Report to [email protected] , GPG key C05FBE60; the finding has to be confirmed by the TYPO3 Security Team before any band is assigned CVSS v4.0 severity determines which rung you land on, and the reward matrix is denominated in euro rather than dollars Individuals only: active TYPO3 Association members are excluded from rewards, so a corporate submitter is not the intended payee Payment lands only after the fix is publicly released, and the annual budget is capped, so a late report in a busy year can meet an empty pot Financial rewards for third-party extension reports ended on 31 May 2026; only the core, and the Association's own infrastructure, still pay TYPO3 also sits in Google Patch Rewards Tier 1 as a popular CMS platform, worth up to $15,000 for a patch you land upstream and keep merged: that is a separate pathway with its own rules, not this bounty Disclosure Coordinated with the TYPO3 Security Team, which batches fixes into scheduled releases and publishes its own advisory. Payment is explicitly tied to the fix going public, so the timeline is the release timeline; nothing in the program rules restricts what you say afterwards, and none of it bars routing the report through a third party. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability