{"id":"GHSA-4h9j-f98m-p4hg","aliases":["CVE-2010-1153"],"title":"TYPO3 PHP remote file inclusion vulnerability","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP code via a URL in an input field associated with the className variable.","severity":"high","score":8.9,"published":"2022-05-02T06:19:32.000Z","modified":"2025-04-11T20:27:15.773Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"typo3/cms","sources":[{"name":"OSV · GHSA-4h9j-f98m-p4hg","url":"https://osv.dev/vulnerability/GHSA-4h9j-f98m-p4hg"}],"ranges":[{"events":[{"introduced":"4.3.0"},{"fixed":"4.3.3"}],"type":"ECOSYSTEM"}],"versions":[],"fixed":["4.3.3"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2010-1153","https://github.com/TYPO3/typo3","https://web.archive.org/web/20100813082506/http://typo3.org/teams/security/security-bulletins/typo3-sa-2010-008","http://marc.info/?l=oss-security&m=127092306209177&w=2","http://www.openwall.com/lists/oss-security/2010/04/12/1"],"sources":[{"name":"OSV","id":"GHSA-4h9j-f98m-p4hg","modified":"2025-04-11T20:27:15.773948Z","url":"https://osv.dev/vulnerability/GHSA-4h9j-f98m-p4hg"}],"assessments":[{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P","score":8.9}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T22:15:33.378Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}