TYPO3 13.4.18

Release Notes

Version 13.4.18

Release Notes for TYPO3 CMS 13.4.18

This document contains information about TYPO3 CMS 13.4.18 which was released on 09.09.2025.

Get TYPO3 13.4.18 now

Checksums of TYPO3 13.4.18

SHA256

36ad0fc6b8c8a05a4acfaed844aad27367a65cf156e899df932295ae621f7ab1 typo3_src-13.4.18.tar.gz
fce66224e820b1cc3ca45b021fda146b86acafcc70d33c5b44e26e233d3a9ba0 typo3_src-13.4.18.zip

SHA1

88c9f0385db69752a8873251890888c3b2cdf026 typo3_src-13.4.18.tar.gz
5ac11982eaf6690645f007d87361718e04384fd9 typo3_src-13.4.18.zip

MD5

9d0e19b319897031938bd2bc692cfab1 typo3_src-13.4.18.tar.gz
a26d5ef2b544d1109203de3459ece778 typo3_src-13.4.18.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/13.4.18/tar.gz
wget --content-disposition https://get.typo3.org/13.4.18/tar.gz.sig
gpg --verify typo3_src-13.4.18.tar.gz.sig typo3_src-13.4.18.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 13.4.17:

  • 2025-09-09 34025c4b165 [RELEASE] Release of TYPO3 13.4.18 (thanks to Oliver Hader)
  • 2025-09-09 f94c41a1db6 [SECURITY] Prevent Information Disclosure in record list downloader (thanks to Benjamin Franzke)
  • 2025-09-09 d98ed12ab6c [SECURITY] Avoid displaying version details to unauthorized users (thanks to Oliver Hader)
  • 2025-09-09 4a879fd4a70 [SECURITY] Inherit access to module-related AJAX routes from modules (thanks to Elias Häußler)
  • 2025-09-09 1d27abe9ea1 [SECURITY] Prevent information disclosure via filesystem E_WARNING errors (thanks to Andreas Kienast)
  • 2025-09-09 8789a8edc0c [SECURITY] Avoid reduced entropy during password generation (thanks to Oliver Hader)
  • 2025-09-09 a6a1272aa1a [SECURITY] Properly catch FAL exceptions in ShortcutRepository (thanks to Oliver Hader)
  • 2025-09-09 c53c8bd19b9 [SECURITY] Fix open redirection via GeneralUtility::sanitizeLocalUrl (thanks to Benjamin Franzke)
  • 2025-09-08 8e42dd06bf8 [TASK] Add more common MIME type replacements and file extensions (thanks to Garvin Hicking)
  • 2025-09-06 087c21f74e8 [TASK] Do not call non static test methods statically (thanks to Helmut Hummel)
  • 2025-09-03 c4008c785c6 [DOCS] Fix Linkvalidator Code Example (thanks to Lukas Niestroj)
  • 2025-09-02 121f0243c59 [TASK] Replace deprecated SplObjectStorage method calls (thanks to Stefan Bürk)
  • 2025-09-02 aee1d5d368a [TASK] Add request to ModifyNewContentElementWizardItemsEvent (thanks to Sebastian Fischer)
  • 2025-09-02 5565b7016f2 [DOCS] Hyphenated words and fulltext search (thanks to Christian Weiske)
  • 2025-09-01 982af12c988 [BUGFIX] Only show preview button in FormEngine when configured (thanks to Benni Mack)
  • 2025-09-01 0659f350d1f [BUGFIX] Do not cast hook arguments in DataHandler (thanks to Benni Mack)
  • 2025-09-01 993a5a11efd [TASK] Update Fluid Standalone to 4.4.3 (thanks to Simon Praetorius)
  • 2025-09-01 6b2ef865bbc [BUGFIX] Ensure correct type of fluidAdditionalAttributes (thanks to Simon Praetorius)
  • 2025-08-31 fd6005508fd [DOCS] Fix FQN of \TYPO3\CMS\Core\Resource\Folder in changelog (thanks to Lina Wolf)
  • 2025-08-30 8eb5f568e78 [BUGFIX] Avoid appending multiple referrer-refresh query parameters (thanks to Oliver Hader)
  • 2025-08-29 a94665dea15 [BUGFIX] Use array accessors inside \TYPO3\CMS\Core\Type\Map (thanks to Oliver Hader)
  • 2025-08-29 9e896cf96fc [BUGFIX] Always clone policy in CSP's Policy::prepare (thanks to Oliver Hader)
  • 2025-08-29 497b62b9884 [BUGFIX] Show online media headline in File Selector (thanks to Oliver Bartsch)
  • 2025-08-28 295021ffb29 [TASK] Enhance Extbase file upload consistency checks (thanks to Oliver Hader)
  • 2025-08-28 a546172308e [DOCS] Update indexed_search fulltext table documentation (thanks to Christian Weiske)
  • 2025-08-28 a9d1b4f1c2c [DOCS] Use proper PDO class constant migration changelog example (thanks to Franz Holzinger)
  • 2025-08-27 b858e0b1ce1 [DOCS] Mark up BE template API examples as code (thanks to Mathias Brodala)
  • 2025-08-27 7c1c619d28d [DOCS] Correct migration instructions for TSFE->getLanguage() (thanks to Markus Klein)
  • 2025-08-22 cc80652d2e4 [TASK] Remove some leftover code in DatabaseRecordList (thanks to Benni Mack)
  • 2025-08-22 610d83c0708 [BUGFIX] Placeholders in error messages are not replaced (thanks to Simon Schaufelberger)
  • 2025-08-22 167e10ee3ad [BUGFIX] Respect system time zone in history module (thanks to Sebastian Michaelsen)
  • 2025-08-22 bb6c85723c3 [BUGFIX] Update middleware name in Configuration (thanks to Christian Kuhn)
  • 2025-08-22 0dba1cecee3 [BUGFIX] Do not cast PID of file reference to int in HTML (thanks to Georg Großberger)
  • 2025-08-22 aa31561c549 [TASK] Refactor workspace BE module internals (thanks to Christian Kuhn)
  • 2025-08-21 b9c54132dcb [BUGFIX] Fix access control for sys_file_metadata (thanks to Oliver Bartsch)
  • 2025-08-21 d262a437891 [DOCS] Update Feature-103511-IntroduceExtbaseFileUploadHandling.rst (thanks to Sergio Catalá)
  • 2025-08-19 5ae8526a0d3 [BUGFIX] Do not change "web" module state in Info Popup (thanks to Oliver Bartsch)
  • 2025-08-19 dd6564703a4 [BUGFIX] Restore sort direction from module data (thanks to Oliver Bartsch)
  • 2025-08-18 250b3c77ca4 [BUGFIX] Consider content object cache lifetimes in HTTP cache headers (thanks to Benni Mack)
  • 2025-08-18 41152b6ceff [BUGFIX] Catch PHP warning when FlexForm select items config is empty (thanks to Christian Weiske)
  • 2025-08-18 b17c0a756c0 [BUGFIX] Respect subgroups of simulated user group (thanks to Albrecht Köhnlein)
  • 2025-08-18 e74170fa355 [BUGFIX] Don't rely on Fluid namespace inheritance (thanks to Simon Praetorius)
  • 2025-08-18 231a74ed4bc [TASK] Remove deprecated function calls with no effect since PHP 8.0 (thanks to Stefan Bürk)
  • 2025-08-18 457d9c8872e [TASK] Update phpunit/phpunit and dependencies (thanks to Stefan Bürk)
  • 2025-08-17 70b525b28e8 [BUGFIX] Remove defaults from required ViewHelper arguments (thanks to Simon Praetorius)
  • 2025-08-16 8c3a8bace00 [BUGFIX] Re-introduce "danger" severity for CacheAction array shape (thanks to Moritz Ngo)
  • 2025-08-15 0d130c6b163 [TASK] Add getSoftReferenceKeys() method to Schema Field API (thanks to Oliver Bartsch)
  • 2025-08-15 f508967c18a [TASK] Drop shouldShowPreselectedValueColumn from formeditor (thanks to Benjamin Kott)
  • 2025-08-14 596f342128e [TASK] CGL: Have basic ordered_class_elements rule (thanks to Christian Kuhn)
  • 2025-08-14 9623684d18d [BUGFIX] Treat page translation as page edit permission (thanks to Lisa Kreitz)
  • 2025-08-14 a427bc463eb [BUGFIX] Set live context when generating $liveUrl in PreviewController (thanks to Sebastian Michaelsen)
  • 2025-08-14 471da7e7611 [TASK] Set TYPO3 version to 13.4.18-dev (thanks to Oliver Hader)