TYPO3 12.4.37

Release Notes

Version 12.4.37

Release Notes for TYPO3 CMS 12.4.37

This document contains information about TYPO3 CMS 12.4.37 which was released on 09.09.2025.

Get TYPO3 12.4.37 now

Checksums of TYPO3 12.4.37

SHA256

84c923ce22acb211dee281e1c03cdd90e29e5aedc9176b38ccd59e1e506cd9d6 typo3_src-12.4.37.tar.gz
05a32cff15fbcc63fe5fc23bab952c4c956bdbd387b86a77d5d772c9d020a9b3 typo3_src-12.4.37.zip

SHA1

1b82a6a33e5edeece15908ad2e452738a21eda91 typo3_src-12.4.37.tar.gz
17a63f155ac923de71c633ea5ed2095e997c9dcf typo3_src-12.4.37.zip

MD5

0c7b596606e227c27c4f3526e3a229d0 typo3_src-12.4.37.tar.gz
bb588efb6be2c1b7def116691b0aafcb typo3_src-12.4.37.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/12.4.37/tar.gz
wget --content-disposition https://get.typo3.org/12.4.37/tar.gz.sig
gpg --verify typo3_src-12.4.37.tar.gz.sig typo3_src-12.4.37.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 12.4.36:

  • 2025-09-09 fa6ceeff93e [RELEASE] Release of TYPO3 12.4.37 (thanks to Oliver Hader)
  • 2025-09-09 6f3dd750db5 [SECURITY] Prevent Information Disclosure in record list downloader (thanks to Benjamin Franzke)
  • 2025-09-09 55fb3a19d7d [SECURITY] Avoid displaying version details to unauthorized users (thanks to Oliver Hader)
  • 2025-09-09 4d4c4d99ea0 [SECURITY] Inherit access to module-related AJAX routes from modules (thanks to Elias Häußler)
  • 2025-09-09 81f24f4baaa [SECURITY] Prevent information disclosure via filesystem E_WARNING errors (thanks to Andreas Kienast)
  • 2025-09-09 bb180be22fd [SECURITY] Avoid reduced entropy during password generation (thanks to Oliver Hader)
  • 2025-09-09 ecaa3a20f5d [SECURITY] Properly catch FAL exceptions in ShortcutRepository (thanks to Oliver Hader)
  • 2025-09-09 c59f90fbd0f [SECURITY] Fix open redirection via GeneralUtility::sanitizeLocalUrl (thanks to Benjamin Franzke)
  • 2025-09-08 76a312431ba [TASK] Add more common MIME type replacements and file extensions (thanks to Garvin Hicking)
  • 2025-09-02 bf194319d08 [TASK] Replace deprecated SplObjectStorage method calls (thanks to Stefan Bürk)
  • 2025-09-02 de5ede57715 [DOCS] Hyphenated words and fulltext search (thanks to Christian Weiske)
  • 2025-08-29 0e8ac34533a [BUGFIX] Use array accessors inside \TYPO3\CMS\Core\Type\Map (thanks to Oliver Hader)
  • 2025-08-29 85bf40e424a [BUGFIX] Always clone policy in CSP's Policy::prepare (thanks to Oliver Hader)
  • 2025-08-28 4b8f477274d [DOCS] Update indexed_search fulltext table documentation (thanks to Christian Weiske)
  • 2025-08-27 ae8801d7eb2 [DOCS] Mark up BE template API examples as code (thanks to Mathias Brodala)
  • 2025-08-22 f84998d9035 [BUGFIX] Avoid PHP errors with broken FE URL arguments (thanks to Christian Kuhn)
  • 2025-08-22 b15b40e01cf [BUGFIX] Do not calculate negative cache lifetime (thanks to Christian Kuhn)
  • 2025-08-22 07bb58cd82d [BUGFIX] Do not cast PID of file reference to int in HTML (thanks to Georg Großberger)
  • 2025-08-18 c44a8c30a30 [TASK] Remove deprecated function calls with no effect since PHP 8.0 (thanks to Stefan Bürk)
  • 2025-08-18 f61dd917684 [TASK] Update phpunit/phpunit and dependencies (thanks to Stefan Bürk)
  • 2025-08-15 461baed0ff1 [BUGFIX] Correctly handle TextTableElement delimiter fallback (thanks to Christian Weiske)
  • 2025-08-14 03d29f64814 [TASK] Set TYPO3 version to 12.4.37-dev (thanks to Oliver Hader)