TYPO3 14.3.3

Release Notes

Version 14.3.3

Release Notes for TYPO3 CMS 14.3.3

This document contains information about TYPO3 CMS 14.3.3 which was released on 09.06.2026.

Get TYPO3 14.3.3 now

Checksums of TYPO3 14.3.3

SHA256

8b41d50d7aec1866ca4e07dab58f55e8b5c835b268a17d80c82f8ce7f23ea6ab typo3_src-14.3.3.tar.gz
2b89d857c1e46c7bd2c281750cbfb54ee23bbe4ab28a6191d7252b078096460c typo3_src-14.3.3.zip

SHA1

42b9b4c946255924c227b10ab0ccad52310ca181 typo3_src-14.3.3.tar.gz
2bcffb362adaeb7dbece630a06ebd52ae539f158 typo3_src-14.3.3.zip

MD5

3629b97d026a775eef2f5442ac5623e5 typo3_src-14.3.3.tar.gz
3db948247c83cc6a02967a7354cb4c69 typo3_src-14.3.3.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/14.3.3/tar.gz
wget --content-disposition https://get.typo3.org/14.3.3/tar.gz.sig
gpg --verify typo3_src-14.3.3.tar.gz.sig typo3_src-14.3.3.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 14.3.2:

  • 2026-06-09 e16ec78165a [RELEASE] Release of TYPO3 14.3.3 (thanks to Oliver Hader)
  • 2026-06-09 36771d5071a [SECURITY] Properly evaluate .form.yaml file extension (thanks to Oliver Hader)
  • 2026-06-09 484bd0c18d1 [SECURITY] Mitigate deserialization flaws (thanks to Oliver Hader)
  • 2026-06-09 e9e9b51510a [SECURITY] Guard form_definition DataHandler access (thanks to Oliver Hader)
  • 2026-06-09 3aab4127411 [SECURITY] Fix path prefix confusion in isAllowedAbsPath (thanks to Oliver Hader)
  • 2026-06-09 b64644eed5c [SECURITY] Check file permissions before showing meta data (thanks to Oliver Hader)
  • 2026-06-09 8e387f41f80 [SECURITY] Check record/file access when adding records to clipboard (thanks to Elias Häußler)
  • 2026-06-09 c93cd2fa08d [SECURITY] Avoid download from fallback storage in FileDownloadController (thanks to Torben Hansen)
  • 2026-06-09 83212c039ff [SECURITY] Prevent unauthorized record move via DataHandler (thanks to Torben Hansen)
  • 2026-06-09 8cd21c87084 [SECURITY] Validate permissions on record undelete (thanks to Elias Häußler)
  • 2026-06-09 aa9e45faff0 [SECURITY] Encode indexed search results in frontend rendering (thanks to Oliver Hader)
  • 2026-06-09 9ebf52e6b5a [SECURITY] Fix open redirection in GeneralUtility::sanitizeLocalUrl (thanks to Benjamin Franzke)
  • 2026-06-09 fae022502a6 [SECURITY] Properly detect .form.yaml suffixes in resource layer (thanks to Oliver Hader)
  • 2026-06-09 13a3fb35cf9 [SECURITY] Deny destructive write actions on mount folders (thanks to Elias Häußler)
  • 2026-06-09 c7d996ee7f0 [SECURITY] Raise typo3/html-sanitizer to v2.3.2 (thanks to Oliver Hader)
  • 2026-06-09 5736315749e [BUGFIX] Prevent exception when using BU::daysUntil w/ DateTime (thanks to Garvin Hicking)
  • 2026-06-08 0318a11747a [BUGFIX] Drop f:format.raw on SiteConfiguration returnUrl field (thanks to Oliver Hader)
  • 2026-06-08 2157113d527 [BUGFIX] Always render internal description in backend preview (thanks to Ravi Sachaniya)
  • 2026-06-06 3bf1fc69597 [TASK] Update phpstan to 2.2.2 (thanks to Anja Leichsenring)
  • 2026-06-06 8c27b497a37 [BUGFIX] Restore titleField support in MenuProcessor (thanks to Anton Danilov)
  • 2026-06-05 6f3f07eb966 [BUGFIX] Fix string splitting and event binding for constant editor type "wrap" (thanks to Stefan Froemken)
  • 2026-06-05 7021ccdfb64 [TASK] Harden toggleRecordVisibilityAction access checks (thanks to Shubham Pise)
  • 2026-06-05 b2a1dd311f3 [BUGFIX] Respect position "top" in EMU::addTcaSelectItemGroup() (thanks to Sebastian Iffland)
  • 2026-06-05 1704371631b [BUGFIX] Avoid redundant scans during language pack updates (thanks to Benni Mack)
  • 2026-06-05 4fb5356a09a [BUGFIX] Avoid exception in suggest wizard for type-less tables (thanks to Christian Kuhn)
  • 2026-06-05 67ccbfa333d [DOCS] Fix module access gate changelog example (thanks to Lina Wolf)
  • 2026-06-05 98e2be617a3 [BUGFIX] Skip label_alt processing when formattedLabel_userFunc is set (thanks to Benni Mack)
  • 2026-06-05 a9a3cdb3f9e [DOCS] Clarify dataStructureKey usage in Breaking-107047 (thanks to Christian Kuhn)
  • 2026-06-04 e3ed95f1038 [TASK] Free EXT:styleguide from hard requirements form/fsc/seo/search (thanks to Garvin Hicking)
  • 2026-06-04 f9395699de7 [DOCS] Add changelog entry for CType/colPos locked on translations (thanks to Johannes Seipelt)
  • 2026-06-04 d84db26bcea [DOCS] Remove leftover workspace swap feature descriptions (thanks to Christian Kuhn)
  • 2026-06-04 27e03b6c259 [DOCS] Name correct removed property in Breaking-101266 (thanks to Christian Kuhn)
  • 2026-06-03 26ab516f2b3 [TASK] Avoid deprecated useNonce asset argument in styleguide (thanks to Christian Kuhn)
  • 2026-06-02 04b0ba10dfb [TASK] Extract DeserializationService from PolymorphicDeserializer (thanks to Oliver Hader)
  • 2026-06-02 115c3c76ac4 [BUGFIX] Ensure type of FolderInterface when building folder rootline (thanks to Andreas Kienast)
  • 2026-06-02 6611fa05e32 [TASK] Streamline test cases (thanks to Oliver Hader)
  • 2026-06-02 7f24fc1ee5c [BUGFIX] Avoid deprecated recordEditAccessInternals() call (thanks to Christian Kuhn)
  • 2026-06-02 e0c018e7e1a [BUGFIX] Enforce isEnabled() check in ResetPasswordController (thanks to Oliver Hader)
  • 2026-06-02 e208a67592b [BUGFIX] Set content area identifier in styleguide FE page layout (thanks to Christian Kuhn)
  • 2026-06-01 d25251db187 [BUGFIX] Use User setting "Max title length" consistently across the backend (thanks to Dennis Purisevic)
  • 2026-06-01 46dc98c1e57 [BUGFIX] Use unique ID for resource pointer fields in multi-upload field (thanks to Elias Häußler)
  • 2026-06-01 bc907553dca [BUGFIX] Pass hasDiff parameter at correct position to workspaceState() (thanks to Andreas Häfner)
  • 2026-06-01 be95ba9655c [TASK] Revert "[TASK] Include current site in cache tag collection" (thanks to Benjamin Franzke)
  • 2026-05-30 854494b0abe [BUGFIX] Guard against uninitialized setup array in TranslationService (thanks to Oliver Bartsch)
  • 2026-05-30 0922fbd2b4e [DOCS] Restructure form editor JavaScript documentation into sub-pages (thanks to Josua Vogel)
  • 2026-05-30 3af8426bff2 [BUGFIX] Avoid PageRepository->__construct()->init() DB call (thanks to Christian Kuhn)
  • 2026-05-30 2e98831f612 [TASK] Add AfterTaskExecutionEvent to EXT:scheduler (thanks to Georg Ringer)
  • 2026-05-28 38ba4d65766 [BUGFIX] Sync displayed HTTP status code with actual response header in ProductionExceptionHandler (thanks to Josua Vogel)
  • 2026-05-28 47ba72031f8 [BUGFIX] Guard getProperties() call in TranslationService with instanceof check (thanks to Josua Vogel)
  • 2026-05-28 72e711eabae [BUGFIX] Run cache GC in chunks (thanks to Johannes Kasberger)
  • 2026-05-28 309cf0853d9 [TASK] Raise phpstan/phpstan to 2.2.1 (thanks to Oliver Hader)
  • 2026-05-28 def2071ff14 [TASK] Clarify what the storage tests actually verify (thanks to Stefan Bürk)
  • 2026-05-28 1f256ee134f [BUGFIX] Re-add SchedulerTaskRepository::add() and findRecordByUid() (thanks to Benni Mack)
  • 2026-05-28 333953fbe88 [TASK] Allow TTY/non-interactive detection in runTests.sh (thanks to Garvin Hicking)
  • 2026-05-28 453aa0ca861 [TASK] Raise symfony/* packages to 7.4.13 (thanks to Oliver Hader)
  • 2026-05-26 9df9ebd9c55 [TASK] Set TYPO3 version to 14.3.3-dev (thanks to Oliver Hader)