TYPO3 14.3.6

Release Notes

Version 14.3.6

Release Notes for TYPO3 CMS 14.3.6

This document contains information about TYPO3 CMS 14.3.6 which was released on 11.08.2026.

Get TYPO3 14.3.6 now

News

This release is a combined bug fix and security release.

Find more details in the security bulletins:

Read TYPO3 14.3.6 Release News

Checksums of TYPO3 14.3.6

SHA256

cd6028c5e5a8777afc9dbb79773e59451a2bdd858bb4ae20bace5b7711a83099 typo3_src-14.3.6.tar.gz
5225b59f7cc10973302a73bbc1b51f0bfecb818b07f9381585d043437afc68a4 typo3_src-14.3.6.zip

SHA1

fcfb58464f6df79d4a7aaa84ed37573e0f79f568 typo3_src-14.3.6.tar.gz
716e4e15aed3c12ba012fb1ee7efc48d94064cfd typo3_src-14.3.6.zip

MD5

ba37ed4e8cf800e1775776ebb0c75667 typo3_src-14.3.6.tar.gz
6761e6029230690fe52a42d9eea3b333 typo3_src-14.3.6.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/14.3.6/tar.gz
wget --content-disposition https://get.typo3.org/14.3.6/tar.gz.sig
gpg --verify typo3_src-14.3.6.tar.gz.sig typo3_src-14.3.6.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 14.3.5:

  • 2026-08-11 dea0f4d4535 [RELEASE] Release of TYPO3 14.3.6 (thanks to Oliver Hader)
  • 2026-08-11 a0e8ee06a40 [SECURITY] Prevent local Fetch/XHR-based request forgery via XSS (thanks to Benjamin Franzke)
  • 2026-08-11 776fee63bc0 [TASK] Decouple session cookie emission from user authentication (thanks to Benni Mack)
  • 2026-08-11 5e9e3cad724 [TASK] Raise phpunit/phpunit to ^11.5.56 (thanks to Stefan Bürk)
  • 2026-08-11 23948d24922 [BUGFIX] Fix PCRE regex breaking suggest wizard on line breaks (thanks to Oliver Heins)
  • 2026-08-11 6ab4704681e [BUGFIX] Correctly parse ORDER BY clauses with FIND_IN_SET (thanks to Christian Spoo)
  • 2026-08-11 d6f922e6fd8 [BUGFIX] Fix broken module link in breadcrumb (thanks to Josua Vogel)
  • 2026-08-11 82f1545d048 [BUGFIX] Implode nested placeholder arrays (thanks to Benjamin Kott)
  • 2026-08-10 3f89a8e1ec7 [TASK] Update npm package dompurify to 3.4.13 (thanks to Oliver Hader)
  • 2026-08-10 03128197e51 [TASK] Promote psr/clock to an explicit core dependency (thanks to Benni Mack)
  • 2026-08-10 044f74f700c [BUGFIX] Create file dump tokens with SHA3-256 everywhere (thanks to Benni Mack)
  • 2026-08-10 8225f3334c1 [BUGFIX] Fix free mode rendering in comparison view (thanks to Marcel Küpper)
  • 2026-08-10 c98a5a5a633 [TASK] Keep the docheader navigation row sticky (thanks to Sebastian Michaelsen)
  • 2026-08-10 8b44e39cfd8 [BUGFIX] Adjust page access check to include create permissions (thanks to René Pflamm)
  • 2026-08-10 224118cfd67 [BUGFIX] Round simulated preview time up to full minutes (thanks to Dennis Bork)
  • 2026-08-10 2932656a35c [TASK] Sticky language header in comparison view (thanks to Marcel Küpper)
  • 2026-08-10 696e5240acd [TASK] Raise render-guides documentation renderer to 0.40.x (thanks to Garvin Hicking)
  • 2026-08-10 788f835d344 [TASK] Allow execution with PHP 8.6 in runTests.sh (thanks to Stefan Bürk)
  • 2026-08-10 a71388230ce [BUGFIX] Respect and apply configured CSS classes from file list actions (thanks to Elias Häußler)
  • 2026-08-10 08e60488c4d [TASK] Announce failed login attempts on invalid request token (thanks to Benni Mack)
  • 2026-08-08 f84bdd46023 [BUGFIX] Allow extbase files in SrcsetViewHelper (thanks to Albrecht Köhnlein)
  • 2026-08-07 391c4d75f2e [BUGFIX] Defer BE_USER check in DataHandler::hasPageContextPermission (thanks to Oliver Hader)
  • 2026-08-07 1934701b31a [BUGFIX] Change placeholder for the locale to use correct locale format (thanks to Dmitry Dulepov)
  • 2026-08-07 cfa1149c4a6 [BUGFIX] Remove anchor links in Installation-Wide Options descriptions (thanks to Philipp Thiele)
  • 2026-08-07 05cc0d0398f [TASK] Add contextual option to editRecord ViewHelper (thanks to Tim Bäcker)
  • 2026-08-07 da0c8bad6f5 [BUGFIX] Fix Linkvalidator Data too long for column 'headline' (thanks to Niklas Grieger)
  • 2026-08-07 2d18a8183ad [TASK] Add darkmode awareness to backend error messages (thanks to Philip Kuban)
  • 2026-08-07 8d7c78e2d95 [BUGFIX] Set correct positioning of upload progressbar (thanks to lukasdoerr)
  • 2026-08-06 7f2756d7cfc [BUGFIX] Do not split paragraphs at inner linebreaks (thanks to Benjamin Kott)
  • 2026-08-06 d9adc3c0f1e [BUGFIX] Render icon labels in backend preview (thanks to Sebastian Klein)
  • 2026-08-06 4de36cfcb41 [TASK] Raise guzzlehttp/* dependencies (thanks to Andreas Kienast)
  • 2026-08-06 49971b46673 [BUGFIX] Fix exception on initial TYPO3 setup with empty database (thanks to Garvin Hicking)
  • 2026-08-05 abdcb61a6aa [BUGFIX] Sanitize children before unwrapping a/h1-h6 in preview (thanks to Oliver Hader)
  • 2026-08-05 47b8e0104fc [TASK] Remove unused variable in ext:install AuthenticationService (thanks to Oliver Hader)
  • 2026-08-04 29f1cf8ea9c [TASK] Update christian-riesen/base32 to v2 (thanks to Wouter Wolters)
  • 2026-08-04 c7c327b3fe5 [BUGFIX] Respect disabled and overridden User Settings fields (thanks to Benni Mack)
  • 2026-08-03 1d43aea8681 [BUGFIX] Add Content-Encoding headers to error pages (thanks to Bastien Lutz)
  • 2026-08-03 8d0d460ea98 [TASK] Add type annotations for DataHandler::$substNEWwithIDs property (thanks to Elias Häußler)
  • 2026-08-02 7bf02f22286 [TASK] Streamline PersistenceManager(Interface) type annotations (thanks to Oliver Klee)
  • 2026-08-02 f8629a37f2b [BUGFIX] Honour AsMessageHandler::$fromTransport property (thanks to Stefan Bürk)
  • 2026-08-02 61fff442362 [TASK] Use Doctrine introspection API for table and database names (thanks to Stefan Bürk)
  • 2026-08-01 763568052d1 [BUGFIX] Do not render "new element" button on SummaryPage in form editor (thanks to Josua Vogel)
  • 2026-08-01 faf60eea222 [BUGFIX] Find translations with empty l10n_source (thanks to Stefan Bürk)
  • 2026-08-01 3c66e928274 [BUGFIX] Avoid PHP warning on logout via login_status POST (thanks to Benni Mack)
  • 2026-08-01 4079b004c8e [TASK] Add JUnit logging to unit and functional CI jobs (thanks to Benni Mack)
  • 2026-08-01 c708374d404 [BUGFIX] Isolate update check from download queue (thanks to Stefan Bürk)
  • 2026-08-01 ded172359d1 [BUGFIX] Cast debug value to string before translating in Adminpanel (thanks to Maike Kiebele)
  • 2026-08-01 374a69c7932 [DOCS] Document purpose and use-cases of PlainDataResolver (thanks to Benni Mack)
  • 2026-08-01 99846189f52 [TASK] Add functional tests for user authentication chain (thanks to Benni Mack)
  • 2026-07-31 f4b5fabab55 [BUGFIX] Do not let record browser inherit module language filter (thanks to Oliver Bartsch)
  • 2026-07-31 0631fdddfad [BUGFIX] Point ActiveRelation to the foreign table for MM relations (thanks to Benni Mack)
  • 2026-07-31 cd2f2b072b1 [TASK] Migrate dashboard creation to the backend wizard (thanks to Benjamin Kott)
  • 2026-07-31 0234d39300c [BUGFIX] Use $this-> instead of self:: in tests (thanks to Benni Mack)
  • 2026-07-30 a2b09876f84 [BUGFIX] root-htaccess must allow ICO files for versioned static files (thanks to Markus Klein)
  • 2026-07-30 f33103da77e [TASK] Identify remote packages by key, version and remote (thanks to Benni Mack)
  • 2026-07-30 71672af99b6 [TASK] Add allowed schema names to TCA schema group field type (thanks to Benni Mack)
  • 2026-07-30 0774bfa594c [TASK] Declare functional test instance configuration as properties (thanks to Benni Mack)
  • 2026-07-30 a3796cbcbd2 [TASK] Raise property-info, adapt ClassSchema tests (thanks to Stefan Bürk)
  • 2026-07-30 6db90f9f470 [TASK] Document meta tag precedence of page properties over TypoScript (thanks to Benni Mack)
  • 2026-07-30 5e47f8cadf7 [BUGFIX] Treat Messenger wildcard route as fallback (thanks to Stefan Bürk)
  • 2026-07-30 cef9ac1473a [TASK] Split tableDef explicitly in cache lifetime (thanks to Stefan Bürk)
  • 2026-07-29 6566c7665c8 [BUGFIX] Prevent "danger" class for empty redirect integrity (thanks to Christian Bülter)
  • 2026-07-29 bcfef45ddc9 [BUGFIX] Render nothing in f:image for unavailable files (thanks to Benni Mack)
  • 2026-07-29 ce594791fa1 [BUGFIX] Adjust blinded database connection options (thanks to Stefan Bürk)
  • 2026-07-29 81eb041826d [BUGFIX] Use proper EnvironmentController test transparency generation (thanks to Garvin Hicking)
  • 2026-07-29 b5f22b674fe [BUGFIX] Allow command "mailer:spool:send" to be schedulable again (thanks to Markus Klein)
  • 2026-07-29 eb72c845e53 [BUGFIX] Avoid TypeError for IMAGE cObject with missing file (thanks to Stig Nørgaard Færch)
  • 2026-07-29 ab1c4b6eba4 [TASK] Have playwright helper middleware authenticate requests (thanks to Garvin Hicking)
  • 2026-07-28 dad7c124de6 [BUGFIX] Respect translated link field of link pages (thanks to Bastien Lutz)
  • 2026-07-28 c1511b80ec8 [BUGFIX] Preserve dots in scalar map keys in form editor model (thanks to Josua Vogel)
  • 2026-07-28 d7b81273d18 [BUGFIX] Allow limited markup in form inspector labels and descriptions (thanks to Josua Vogel)
  • 2026-07-27 e59fbb1e64a [BUGFIX] Use ContextualFeedbackSeverity in extension manager infobox (thanks to Benni Mack)
  • 2026-07-27 86d0da25994 [BUGFIX] Respect tsconfig field label overrides per type (thanks to Bastien Lutz)
  • 2026-07-27 53fe9da717f [BUGFIX] Handle unknown extension list records (thanks to Stefan Bürk)
  • 2026-07-27 7c5abfc6f70 [DOCS] Improve ext:webhooks documentation (thanks to Anja Leichsenring)
  • 2026-07-27 a4a1321e7f8 [TASK] Update PHPStan to v2.2.6 (thanks to Garvin Hicking)
  • 2026-07-25 40f4b5529e7 [BUGFIX] Avoid removed getter in dependency check (thanks to Stefan Bürk)
  • 2026-07-24 3cddc6cf25f [BUGFIX] Respect language overlay type in Extbase (thanks to Mathias Brodala)
  • 2026-07-24 9ddc8b4ccbc [TASK] Add files to livesearch results (thanks to Benjamin Kott)
  • 2026-07-24 989b4776bcf [BUGFIX] Cascade undelete for foreign_field inline records (thanks to Kay Wienöbst)
  • 2026-07-24 8e450818782 Revert "[TASK] GifBuilder: Remove reference marker for GdImage parameters" (thanks to Andreas Kienast)
  • 2026-07-24 4c9f4bce610 [BUGFIX] Hand correlationId over to sub instances of DataHandler (thanks to Benni Mack)
  • 2026-07-24 5cd9ec316f3 [TASK] Clean up unit test mock platforms for Doctrine DBAL (thanks to Stefan Bürk)
  • 2026-07-24 9dddf78f21a [BUGFIX] Respect type-specific Page TSconfig labels (thanks to Can Adrian Karadag)
  • 2026-07-24 67796987abf [TASK] GifBuilder: Remove reference marker for GdImage parameters (thanks to Andreas Kienast)
  • 2026-07-23 90b72a02622 [BUGFIX] Keep all PSR-4 paths of shared prefixes (thanks to Stefan Bürk)
  • 2026-07-23 d52f76623b1 [BUGFIX] Allow non-scheme protocol URI as CSP site base (thanks to Benjamin Serfhos)
  • 2026-07-23 29a957bf27d [TASK] Do not rely on Doctrine schema object array keys (thanks to Stefan Bürk)
  • 2026-07-23 3d1c088b14c [BUGFIX] Evaluate sortDesc parameter correctly in indexed_search (thanks to Tobias Wojtylak)
  • 2026-07-23 a3163e620e6 [TASK] Streamline file upload handling in ext:impexp (thanks to Oliver Hader)
  • 2026-07-23 180982246df [BUGFIX] Prevent infinite recursion for self-linking doktype=3 pages (thanks to Oliver Hader)
  • 2026-07-23 b0d7869ced5 [BUGFIX] Fix broken TableDiff::getDroppedForeignKeyConstraintNames() (thanks to Stefan Bürk)
  • 2026-07-23 c1e6c4a88a1 [BUGFIX] Honor parameter types in writable Connection methods (thanks to Stefan Bürk)
  • 2026-07-22 407315fd274 [TASK] Avoid deprecated Doctrine DBAL identifier quoting (thanks to Stefan Bürk)
  • 2026-07-22 c7546976b27 [BUGFIX] Merge size info into a single row in file info panel (thanks to Gianluigi Martino)
  • 2026-07-22 7b71cd2a2cd [BUGFIX] Preserve option order of DB-stored forms on MySQL (thanks to Oliver Bartsch)
  • 2026-07-22 1e69f2e476b [TASK] Avoid $GLOBALS['TCA'] in EXT:styleguide (thanks to Benni Mack)
  • 2026-07-21 044ade1ec9f [BUGFIX] Resolve subpages of translated mount points (thanks to André Buchmann)
  • 2026-07-21 74311f79dd4 [BUGFIX] Ensure that failed attempts to send via MemorySpool are logged (thanks to Stephan Großberndt)
  • 2026-07-21 51653ceb9e4 [BUGFIX] Do not break fixed positioning inside modals (thanks to Benjamin Kott)
  • 2026-07-21 28493632243 [BUGFIX] Blind "DB/Connections/Default/url" in TYPO3 BE (thanks to Mathias Brodala)
  • 2026-07-21 6f729a0c6ae [TASK] Test against latest RDBMS versions (thanks to Benni Mack)
  • 2026-07-21 42334a3087c [BUGFIX] Elevate new MariaDB and Postgres platforms (thanks to Stefan Bürk)
  • 2026-07-21 eb5c5ef36c2 [TASK] Extend runTests.sh database version matrix (thanks to Stefan Bürk)
  • 2026-07-21 d7bf3fe9117 [TASK] Throw error when DocHeaderComponent has multiple menus (thanks to Garvin Hicking)
  • 2026-07-20 cb68116618f [BUGFIX] Fix table option lookup on MariaDB 11.4+ (thanks to Stefan Bürk)
  • 2026-07-17 6a5b193bc2e [BUGFIX] Prevent multiple identifier quoting in new Extbase QoM methods (thanks to Garvin Hicking)
  • 2026-07-17 c9e21863113 [BUGFIX] DateTime fields for slugs (thanks to Markus Klein)
  • 2026-07-17 36a4b1fec04 [TASK] Allow skipping the summary step in the backend wizard (thanks to Benjamin Kott)
  • 2026-07-17 aacdc38b532 [BUGFIX] Make LogRecord writeable ArrayAccess / offsetSet (thanks to Benni Mack)
  • 2026-07-17 06afb8e7f0a [BUGFIX] Extbase must ignore enable fields in Backend (thanks to Markus Klein)
  • 2026-07-17 3b94824cb0c [TASK] Avoid unset() on protected class properties (thanks to Benni Mack)
  • 2026-07-17 ba453da8993 [BUGFIX] Enhance workspace handling of language synchronization (thanks to Oliver Hader)
  • 2026-07-17 fbef3e6579e [TASK] Remove backend user language "default" (thanks to Ayke Halder)
  • 2026-07-17 f98748eb283 [BUGFIX] Centralize focus handling in the backend wizard (thanks to Benjamin Kott)
  • 2026-07-16 ee3e020b091 [BUGFIX] Respect required but not rendered fields in Page Wizard (thanks to Georg Ringer)
  • 2026-07-16 7d6cb126b53 [BUGFIX] Prevent topbar button name duplication in firefox a11y tree (thanks to Benjamin Franzke)
  • 2026-07-15 0faa04370e7 [TASK] Speed up responsive image loading from db (thanks to Ayke Halder)
  • 2026-07-15 e0169dca718 [BUGFIX] Allow ContentArea usage with f:for iteration (thanks to Matthias Vogel)
  • 2026-07-15 7929b98627b [TASK] Show clipboard buttons in recordlist only if usable (thanks to Georg Ringer)
  • 2026-07-15 0256370adb2 [BUGFIX] Use correct label for records module hint (thanks to Georg Ringer)
  • 2026-07-14 91b5ae1abf0 [BUGFIX] Increase placeholder text contrast (thanks to Christian Jung)
  • 2026-07-14 d612514ed8e [TASK] Set TYPO3 version to 14.3.6-dev (thanks to Oliver Hader)