TYPO3 13.4.23

Release Notes

Version 13.4.23

Release Notes for TYPO3 CMS 13.4.23

This document contains information about TYPO3 CMS 13.4.23 which was released on 13.01.2026.

Get TYPO3 13.4.23 now

Checksums of TYPO3 13.4.23

SHA256

afcd883fb34186da54b8e6611134936777f59b8ae304478dd912a3b81ad650d9 typo3_src-13.4.23.tar.gz
d52c5992ea5fe26bd5ae416c74ae8171ed2c8411b5d22bd823a742add723f5af typo3_src-13.4.23.zip

SHA1

c45d7da4e4fa1b0e3afc53d283b2f2aaf59ab4dc typo3_src-13.4.23.tar.gz
4b7ddd08fbd3a307c873671848531f1ae638ff31 typo3_src-13.4.23.zip

MD5

efb09640f3602f7acab3bb33e86a59db typo3_src-13.4.23.tar.gz
ba0953e08689a78c3401fbbfeeba7ac0 typo3_src-13.4.23.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/13.4.23/tar.gz
wget --content-disposition https://get.typo3.org/13.4.23/tar.gz.sig
gpg --verify typo3_src-13.4.23.tar.gz.sig typo3_src-13.4.23.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 13.4.22:

  • 2026-01-13 ef75ec889ef [RELEASE] Release of TYPO3 13.4.23 (thanks to Oliver Hader)
  • 2026-01-13 e0f0ceee480 [SECURITY] Harden message deserialization in FileSpool transport (thanks to Elias Häußler)
  • 2026-01-13 efb9528f988 [SECURITY] Avoid record deletion without permissions in recycler module (thanks to Elias Häußler)
  • 2026-01-13 bac370df5c1 [SECURITY] Prevent unauthorized access to resources in redirects module (thanks to Elias Häußler)
  • 2026-01-13 fb98378a8fd [SECURITY] Ensure defVals adhere to permissions checks (thanks to Benjamin Franzke)
  • 2026-01-12 de447cf6305 [BUGFIX] Avoid using null as array key in DatabaseRecordList (thanks to Georg Ringer)
  • 2026-01-10 0ff6a54cacc [BUGFIX] Add is_siteroot to select fields in record lists (thanks to Georg Ringer)
  • 2026-01-09 db217f1e37c [TASK] Properly parse prioritized countries with a data attribute (thanks to Josef Glatz)
  • 2026-01-05 ac68b7070fb [BUGFIX] Hide pagination during data fetching in live-search (thanks to Benjamin Kott)
  • 2026-01-02 3008db0690c [TASK] Update copyright year in README.md and INSTALL.md (thanks to Torben Hansen)
  • 2025-12-31 a4fb42374f5 [BUGFIX] Pass timeout to Symfony Process (thanks to Simon Schaufelberger)
  • 2025-12-30 d50c272af04 [TASK] Mask database credentials in stacktrace (thanks to Simon Praetorius)
  • 2025-12-29 db6c9abe580 [BUGFIX] Define setting offlineMode in composer view of Extension Manager (thanks to Georg Ringer)
  • 2025-12-24 a7a75c43efa [TASK] Rename $hash to $hashAlgorithm (thanks to Christian Weiske)
  • 2025-12-24 803fe59f481 [DOCS] Overhaul Form documentation - For Editors (thanks to Sarah McCarthy)
  • 2025-12-24 397e1aaa945 [DOCS] Overhaul TYPO3 Form - For Integrators/Concepts/Form plugin (thanks to Sarah McCarthy)
  • 2025-12-24 eff9e1a03ff [DOCS] Overhaul TYPO3 Form - For Integrators/FAQ (thanks to Sarah McCarthy)
  • 2025-12-24 f2e62093dc2 [DOCS] Overhaul TYPO3 Form - For Integrators/Concepts/Form editor (thanks to Sarah McCarthy)
  • 2025-12-24 1aa5b4a1320 [DOCS] Overhaul TYPO3 Form - For Integrators/Concepts/Form manager (thanks to Sarah McCarthy)
  • 2025-12-24 5a09f3aaa07 [TASK] Update ISO Database (thanks to Anja Leichsenring)
  • 2025-12-24 912c433d77a [TASK] Improve class description for SanitizeFileNameEvent (thanks to Torben Hansen)
  • 2025-12-22 6be39b45b50 [BUGFIX] Remove check of php_tree_stop in PageRepository (thanks to Georg Ringer)
  • 2025-12-19 63d6c718197 [TASK] Avoid Symfony\Component\Console\Application::add (thanks to Benjamin Franzke)
  • 2025-12-19 aec9ced4fa1 [TASK] Add return type declarations in DI processors (thanks to Benjamin Franzke)
  • 2025-12-19 9a8dd815c3e [DOCS] Fix redirect config docs for site sets (thanks to Wolfgang Wagner)
  • 2025-12-19 354778c2bcd [TASK] Specify return type declarations in console commands (thanks to Benjamin Franzke)
  • 2025-12-19 1562be5408d [BUGFIX] Keep nonce sources set by f:security.nonce view-helper (thanks to Oliver Hader)
  • 2025-12-18 abd839b7475 [BUGFIX] Avoid php errors due to missing BE_USER (thanks to Simon Praetorius)
  • 2025-12-18 36e1511bad0 [TASK] Solve various PHP errors (thanks to Benni Mack)
  • 2025-12-18 97e3fa0f950 [BUGFIX] Prevent TypeError on empty server type input in setup command (thanks to Lina Wolf)
  • 2025-12-18 926c2661cac [TASK] Harden FluidPageErrorHandler (thanks to Torben Hansen)
  • 2025-12-18 7c18c29b6b1 [TASK] Reflect non-empty-string return type in HashScope::prefix() (thanks to Elias Häußler)
  • 2025-12-18 200b0615a26 [BUGFIX] Support TCEFORM altLabels override for empty values (thanks to Can Adrian Karadag)
  • 2025-12-18 d3e16f6d575 [BUGFIX] Fix invalid CSS selectors in adminpanel stylesheet (thanks to Benjamin Kott)
  • 2025-12-18 d3c39afaece [BUGFIX] Do not render "Create new record" button in single table view (thanks to Oliver Bartsch)
  • 2025-12-15 eb3d20f2c86 [BUGFIX] Respect admPanel.override in ViewHelperResolver (thanks to Stefan Froemken)
  • 2025-12-13 aa990f1ead9 [TASK] Extend DataHandler hard delete test cases (thanks to Oliver Hader)
  • 2025-12-12 ca57e3d049c [TASK] Avoid "Using null as an array offset is deprecated" (thanks to Josef Glatz)
  • 2025-12-12 6ed6600baf2 [BUGFIX] Avoid undefined array key access in DependencyOrderingService (thanks to Sebastien Convers)
  • 2025-12-12 fc4a71b5141 [BUGFIX] Fix "separated" typo in "backend:user:create" command (thanks to Mathias Brodala)
  • 2025-12-12 e386e36b13c [BUGFIX] Fix "separated" typo in "scheduler:execute" command (thanks to Mathias Brodala)
  • 2025-12-12 784e60eb539 [BUGFIX] Naturally sort extension settings (thanks to Thomas Hohn)
  • 2025-12-12 12c56c556e0 [TASK] Fix typo in DropDownButton API example (thanks to Georg Ringer)
  • 2025-12-11 e893a9fa448 [TASK] Adjust and relocate runTests watchRst templates (thanks to Garvin Hicking)
  • 2025-12-10 a8e2190f815 [BUGFIX] Properly remove anchors from login logo (thanks to Oliver Hader)
  • 2025-12-09 fdc388af476 [TASK] Update typo3/cms-composer-installers to ^5.0.2 (thanks to Josef Glatz)
  • 2025-12-09 5c6f498c01a [DOCS] Correct main module name in form documentation (thanks to Chris Müller)
  • 2025-12-09 1c1b5e0e72e [BUGFIX] Avoid possible warning calling DataHandler->updateDB() (thanks to Christian Kuhn)
  • 2025-12-09 ad3960797a3 [TASK] Set TYPO3 version to 13.4.23-dev (thanks to Oliver Hader)