TYPO3 14.3.5

Release Notes

Version 14.3.5

Release Notes for TYPO3 CMS 14.3.5

This document contains information about TYPO3 CMS 14.3.5 which was released on 14.07.2026.

Get TYPO3 14.3.5 now

News

This release is a combined bug fix and security release.

Find more details in the security bulletins:

Read TYPO3 14.3.5 Release News

Checksums of TYPO3 14.3.5

SHA256

27505ece380cc0d147e15f91de17553085fc3ded6b5ab8e1e7d9922b27bf356d typo3_src-14.3.5.tar.gz
bfac6e583aeb142a003600f4ef8553d33003982fd55e0a9b1b9eb005050f3a1d typo3_src-14.3.5.zip

SHA1

5c0756421f830584519bc1b6c56b5f240d198c20 typo3_src-14.3.5.tar.gz
bf944601e315ca5ac401447b94c0bc29c16fc52a typo3_src-14.3.5.zip

MD5

cea782c8256d357571d5f91db4772564 typo3_src-14.3.5.tar.gz
178835dd5196bd9add380fbc9606674e typo3_src-14.3.5.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/14.3.5/tar.gz
wget --content-disposition https://get.typo3.org/14.3.5/tar.gz.sig
gpg --verify typo3_src-14.3.5.tar.gz.sig typo3_src-14.3.5.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 14.3.4:

  • 2026-07-14 38d9edb7b28 [RELEASE] Release of TYPO3 14.3.5 (thanks to Oliver Hader)
  • 2026-07-14 cfda2105039 [SECURITY] Register MimeTypeValidator for file uploads at runtime (thanks to Josua Vogel)
  • 2026-07-14 b9ba2f9ce69 [BUGFIX] Refine exceptions to root-level restriction in DataHandler (thanks to Oliver Hader)
  • 2026-07-14 50a0b4fabb5 [TASK] Raise guzzlehttp/* dependencies (thanks to Oliver Hader)
  • 2026-07-13 d362d508c06 [BUGFIX] Use form-check pattern for sync crop variants checkbox (thanks to Josua Vogel)
  • 2026-07-13 01e958493eb [BUGFIX] Hide EXT:workspaces preview for non-previewable records (thanks to Garvin Hicking)
  • 2026-07-13 1fdb48dbb7c [TASK] Support Mastodon social media icon in Camino theme (thanks to Garvin Hicking)
  • 2026-07-10 3af000c3e60 [BUGFIX] Sanitize and size SVG via dedicated SvgDocument classes (thanks to Benjamin Kott)
  • 2026-07-10 a9e514bd926 [BUGFIX] Add accessible label to language flag in content element header (thanks to Christian Rath-Ulrich)
  • 2026-07-10 8a02da7d255 [TASK] Streamline title of EXT:backend (thanks to Andreas Kienast)
  • 2026-07-09 21d36e90412 [TASK] Correct Camino Francés route stats (thanks to rfay)
  • 2026-07-08 6ab0f854d9e [BUGFIX] Revert "[TASK] Identify remote packages by key, version and remote" (thanks to Benjamin Franzke)
  • 2026-07-08 028dd073435 [BUGFIX] Allow to expand ajax error panels in maintenance tool (thanks to Benjamin Franzke)
  • 2026-07-07 230130001b7 [BUGFIX] Read status colors in system information (thanks to Dennis Purisevic)
  • 2026-07-07 a773152b9f0 [TASK] Introduce status indicator component (thanks to Benjamin Kott)
  • 2026-07-06 388118ae600 [DOCS] Document inheritance in ext:form via placeholders (thanks to Josua Vogel)
  • 2026-07-06 663745d6a78 [BUGFIX] Allow new domain syntax for resourceOverrides (thanks to Benni Mack)
  • 2026-07-06 dfe651b5f83 [TASK] Translate scheduler task priorities during rendering (thanks to Benjamin Franzke)
  • 2026-07-05 1122841c4b9 [DOCS] Clarify instruction about stopping scheduler tasks (thanks to Riccardo De Contardi)
  • 2026-07-05 9bd19ae297c [BUGFIX] Return focus to edit icon after page title editing (thanks to Christian Jung)
  • 2026-07-04 ca315c2decb [BUGFIX] Render scheduler task status consistently in module and CLI (thanks to Benjamin Kott)
  • 2026-07-04 6c42bcecc48 [DOCS] Adjust wrong changelog $request() example (thanks to Garvin Hicking)
  • 2026-07-03 ee97ddcd0ff [BUGFIX] Fix bulk execute action in scheduler deleting tasks (thanks to Benni Mack)
  • 2026-07-02 84471020503 [TASK] Identify remote packages by key, version and remote (thanks to Benni Mack)
  • 2026-07-02 d8f4e4746b6 [BUGFIX] Consider all workspace-enabled tables for stage buttons (thanks to Benni Mack)
  • 2026-07-01 c392fa60970 [TASK] Implement and apply custom PHPStan rule to harden unserialize (thanks to Elias Häußler)
  • 2026-07-01 70f1fda870b [BUGFIX] Set automatic redirects to creation_type=0 (automatic) (thanks to Andreas Häfner)
  • 2026-07-01 49361c0dd6e [TASK] Use proper description in "cleanup:previewlinks" command (thanks to Mathias Brodala)
  • 2026-07-01 5ab33aca081 [TASK] Update PHPStan to v2.2.3 (thanks to Elias Häußler)
  • 2026-07-01 bdf1a46277d [BUGFIX] Drop redundant .bind(this) on arrow field cropMoveHandler (thanks to Oliver Hader)
  • 2026-06-30 2d1b59ba5c9 [BUGFIX] Do not report aborted inline requests as errors (thanks to Georg Ringer)
  • 2026-06-30 942597d4112 [TASK] Mark shortcut as required if shortcut_mode=0 (thanks to Bastien Lutz)
  • 2026-06-29 8797b68637a [TASK] Mark disabled pages in language comparison (thanks to Amir Arends)
  • 2026-06-29 b7d59f6102b [BUGFIX] Apply an ellipsis to long URLs in CKEditor link toolbar (thanks to Maike Kiebele)
  • 2026-06-29 155bdc8af70 [BUGFIX] List extension:activate in list of possible commands (thanks to Benjamin Franzke)
  • 2026-06-27 90712a17564 [BUGFIX] Fix initial EXT:introduction database import on sqlite (thanks to Benjamin Franzke)
  • 2026-06-27 60f907f32b0 [TASK] Add request to ModifyPageLinkConfigurationEvent (thanks to Helmut Hummel)
  • 2026-06-26 04c24eae83a [TASK] Prevent PHPUnit warnings on ReflectionService destructor (thanks to Garvin Hicking)
  • 2026-06-26 40d5fd73066 [TASK] Update npm package dompurify to v3.4.11 (thanks to Oliver Hader)
  • 2026-06-26 a36184d1cfc [TASK] Obtain ConnectionPool from container in functional tests (thanks to Benjamin Franzke)
  • 2026-06-26 5443496993c [TASK] Add non-admin backend user and group to FAL DataHandler tests (thanks to Oliver Hader)
  • 2026-06-26 a7b50a7ff50 [BUGFIX] Close all dropzones after upload finishes (thanks to Maike Kiebele)
  • 2026-06-25 84e601b976f [BUGFIX] Show warning for missing workspace or module access (thanks to Oliver Hader)
  • 2026-06-25 2274b4b9b10 [BUGFIX] Allow base64url characters in CorrelationId pattern (thanks to Oliver Hader)
  • 2026-06-25 203ab8e2613 [TASK] Harden redirects history rollback processing (thanks to Oliver Hader)
  • 2026-06-25 ce5314fece7 [BUGFIX] Prevent EXT:linkvalidator failures in CLI reporting (thanks to Garvin Hicking)
  • 2026-06-24 86a86ccd1b1 [BUGFIX] Use "default" as default group (thanks to Georg Ringer)
  • 2026-06-24 25d6d8fb144 [TASK] Promote generateRandomBase64String to public API (thanks to Oliver Hader)
  • 2026-06-23 8acb28e3a3a [BUGFIX] Allow adding entries to an empty settings stringlist (thanks to Wolfgang Klinger)
  • 2026-06-22 1f3588f9126 [BUGFIX] Guard undefined array key in ImageProcessingInstructions (thanks to Garvin Hicking)
  • 2026-06-22 cdccb15a20b [TASK] Use proper "Timing" tab reference for scheduler tasks (thanks to Garvin Hicking)
  • 2026-06-19 dd5735757cb [BUGFIX] root-htaccess must allow XSL files for versioned static files (thanks to Markus Klein)
  • 2026-06-19 b0beeab781a [BUGFIX] Generate matching tags when callRecursive.tagStdWrap is used in parseFunc (thanks to Sebastien Convers)
  • 2026-06-19 a3e0c481709 [BUGFIX] Properly require symfony/polyfill-php84 and php85 (thanks to Garvin Hicking)
  • 2026-06-18 413a5819278 [BUGFIX] Correctly use QueryResultInterface for PHPStan (thanks to Markus Klein)
  • 2026-06-18 56a505a2897 [BUGFIX] Add proper type annotation for DataHandling->errorLog (thanks to Daniel Siepmann)
  • 2026-06-16 cdc129913b0 [TASK] Set TYPO3 version to 14.3.5-dev (thanks to Benni Mack)