TYPO3 11.5.51 ELTS
Release Notes
Stay secure and up-to-date with TYPO3 ELTS!
The TYPO3 CMS community supported from 2020-12-22
until 2024-10-31.
Extend your support now until 2028-10-31 to
get access to the latest security and compatibility updates for this version.
Release Notes for TYPO3 CMS 11.5.51
This document contains information about TYPO3 CMS 11.5.51 which was released on 09.06.2026.
Get TYPO3 11.5.51 nowNews
This release is a combined bug fix and security release.
Find more details in the security bulletins:
- https://typo3.org/security/advisory/typo3-core-sa-2026-006
- https://typo3.org/security/advisory/typo3-core-sa-2026-007
- https://typo3.org/security/advisory/typo3-core-sa-2026-008
- https://typo3.org/security/advisory/typo3-core-sa-2026-009
- https://typo3.org/security/advisory/typo3-core-sa-2026-011
- https://typo3.org/security/advisory/typo3-core-sa-2026-013
- https://typo3.org/security/advisory/typo3-core-sa-2026-014
- https://typo3.org/security/advisory/typo3-core-sa-2026-015
- https://typo3.org/security/advisory/typo3-core-sa-2026-016
- https://typo3.org/security/advisory/typo3-core-sa-2026-018
- https://typo3.org/security/advisory/typo3-core-sa-2026-019
Checksums of TYPO3 11.5.51
SHA256
4a39333cfe57a3ebd565f32746985368b847590db3274200c51e02d83a459544 typo3_src-11.5.51.tar.gz 90387cba8f7ff19b3cbfa24bccfa21789aaf02d2e7c7a4ef16f0fcb04e28752c typo3_src-11.5.51.zip
SHA1
127f95162044adf06b99409a8f5d091ad83687a1 typo3_src-11.5.51.tar.gz 0785fe608cb269d022583660a75e077c5ff0c395 typo3_src-11.5.51.zip
MD5
d41d8cd98f00b204e9800998ecf8427e typo3_src-11.5.51.tar.gz d41d8cd98f00b204e9800998ecf8427e typo3_src-11.5.51.zip
Package Signatures
TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.
Upgrading
The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.
Changes
Here is a list of what was fixed since 11.5.50:
- 2026-06-09 69ccfeaeb2 [RELEASE] Release of TYPO3 11.5.51 (thanks to Andreas Kienast)
- 2026-06-09 4d2ecd0fb7 [SECURITY] Mitigate deserialization flaws (thanks to Oliver Hader)
- 2026-06-09 2b1f6581ba [TASK] Extract DeserializationService from PolymorphicDeserializer (thanks to Oliver Hader)
- 2026-06-09 78c9c83c7e [TASK] Speed up PolymorphicDeserializer::parseClassNames() (thanks to Oliver Hader)
- 2026-06-09 c9ad614daa [TASK] Streamline test cases (thanks to Oliver Hader)
- 2026-06-09 07b320fe97 [SECURITY] Properly evaluate .form.yaml file extension (thanks to Oliver Hader)
- 2026-06-09 955b384101 [SECURITY] Check file permissions before showing meta data (thanks to Oliver Hader)
- 2026-06-09 e40c0e510b [SECURITY] Fix path prefix confusion in isAllowedAbsPath (thanks to Oliver Hader)
- 2026-06-09 16576ad1ac [SECURITY] Check record/file access when adding records to clipboard (thanks to Elias Häußler)
- 2026-06-09 10c4fbd03b [SECURITY] Fix open redirection in GeneralUtility::sanitizeLocalUrl (thanks to Benjamin Franzke)
- 2026-06-09 9679e46604 [SECURITY] Validate permissions on record undelete (thanks to Elias Häußler)
- 2026-06-09 30df069161 [SECURITY] Avoid download from fallback storage in FileDownloadController (thanks to Torben Hansen)
- 2026-06-09 902272de12 [SECURITY] Properly detect .form.yaml suffixes in resource layer (thanks to Oliver Hader)
- 2026-06-09 cb18edc994 [SECURITY] Deny destructive write actions on mount folders (thanks to Elias Häußler)
- 2026-06-09 99d55e1f6f [SECURITY] Raise typo3/html-sanitizer to v2.3.2 (thanks to Oliver Hader)
- 2026-06-09 cde81d51a2 [BUGFIX] Avoid
mixedtype in EXT:redirects (thanks to Andreas Kienast) - 2026-06-09 a04d4b0cda [BUGFIX] Drop f:format.raw on SiteConfiguration returnUrl field (thanks to Oliver Hader)
- 2026-06-08 128b3ea0a5 [TASK] Update all Symfony packages (thanks to Andreas Kienast)
- 2026-05-13 181ccd808c [TASK] Run full CGL check in pre-merge tests (thanks to Andreas Kienast)
- 2026-05-11 bc71035fec [TASK] Normalize backslashes in ZipService::verify() (thanks to Oliver Hader)
- 2026-05-11 6299179525 [TASK] Flush rootline caches in
RedirectRepositoryTest(thanks to Andreas Kienast) - 2026-05-11 f94beec6da [TASK] Fix acceptance tests (thanks to Andreas Kienast)
- 2026-04-22 93a9fdbce6 [BUGFIX] Fix url check in GeneralUtility::sanitizeLocalUrl (thanks to Thomas Hohn)
- 2026-01-20 8f3aed30f0 [TASK] Set TYPO3 version to 11.5.51-dev (thanks to Andreas Kienast)