TYPO3 14.3.7

Release Notes

Version 14.3.7

Release Notes for TYPO3 CMS 14.3.7

This document contains information about TYPO3 CMS 14.3.7 which was released on 08.09.2026.

News

This version is a security release and contains important security fixes - read the corresponding security advisories here:

TYPO3-CORE-SA-2026-022 / CVE-2026-77132: Information Disclosure via Backend Localization Wizard
TYPO3-CORE-SA-2026-023 / CVE-2026-85400: Missing Authorization in lowlevel commands

Read TYPO3 14.3.7 Release News

Checksums of TYPO3 14.3.7

SHA256

1c91921b56615fb961ef37840abb9013e90e95a42f2ba83b61455732be0a353f typo3_src-14.3.7.tar.gz
5e4da61be752a75d5f2b689c7eea11a418e876d95893dde56f74b7fbdbf780ec typo3_src-14.3.7.zip

SHA1

1afb005e8d9a9ed64705146632607352c28cd56e typo3_src-14.3.7.tar.gz
86e95ce15fbeccfdcd87dbe82957ea7e1a1f7300 typo3_src-14.3.7.zip

MD5

cf97fbfa5b673e7c203509eadbd58c7b typo3_src-14.3.7.tar.gz
85200d147eac158cd4476ba252cd49bd typo3_src-14.3.7.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/14.3.7/tar.gz
wget --content-disposition https://get.typo3.org/14.3.7/tar.gz.sig
gpg --verify typo3_src-14.3.7.tar.gz.sig typo3_src-14.3.7.tar.gz

Upgrading

The usual upgrading procedure applies. No database updates are necessary. However some database optimizations are added - executing the database analyzer after upgrading is recommended. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.

Changes

Here is a list of what was fixed since 14.3.6:

2026-09-08 07f4dc8267d [RELEASE] Release of TYPO3 14.3.7 (thanks to Benni Mack)
2026-09-08 e15da7ba021 [SECURITY] Disallow system configuration modification via scheduler (thanks to Elias Häußler)
2026-09-08 35e070fc654 [SECURITY] Check page access in the localization endpoints (thanks to Benjamin Kott)
2026-09-08 bca13ed0e41 [TASK] Revert "[TASK] Harden localization wizard endpoints" (thanks to Benjamin Franzke)
2026-09-08 87601e29157 [BUGFIX] Keep booted container in database analyzer (thanks to Stefan Bürk)
2026-09-08 3e9043dc516 [DOCS] Mention EXT:lowlevel for configuration CLI (thanks to Georg Ringer)
2026-09-07 63bbe1b8baf [BUGFIX] Fix PageRendererFactoryTrait (thanks to Simon Schaufelberger)
2026-09-07 62221ccb9af [BUGFIX] Ensure numeric site identifiers stay strings (thanks to Oliver Bartsch)
2026-09-07 06fa6dae197 [BUGFIX] Move records back when rolling back the record history (thanks to Benni Mack)
2026-09-07 baa09df78da [BUGFIX] Preserve route target when MFA intercepts a route request (thanks to Benjamin Franzke)
2026-09-07 73f14ed99ce [DOCS] Mention the whitespace module for ckeditor (thanks to Anja Leichsenring)
2026-09-07 096691fbf10 [BUGFIX] Avoid stale deleted state on reprocessed files (thanks to Benni Mack)
2026-09-07 c4233bcffb6 [TASK] Autoconfigure ResourceConsistencyService (thanks to Wouter Wolters)
2026-09-07 1ac5e2b3f5d [TASK] Remove redundant sorting in ReferenceIndex (thanks to Wouter Wolters)
2026-09-06 eda4b3993a5 [BUGFIX] Allow unsetting file metadata (thanks to Nicole Hummel)
2026-09-04 046795cbeba [BUGFIX] Preserve child order on IRRE localize/synchronize (thanks to Andreas Wolf)
2026-09-04 61fcdc87be7 [TASK] Improve LinkValidator record lookup performance (thanks to Wouter Wolters)
2026-09-04 ce6c54a428e [BUGFIX] Avoid breadcrumb warning on root page (thanks to Anton Danilov)
2026-09-04 e522fb98211 [BUGFIX] Ensure admin access in "redirects:cleanup" command (thanks to Mathias Brodala)
2026-09-04 c2aa35e2b44 [BUGFIX] Fix various glitches in the record history module (thanks to Benni Mack)
2026-09-04 41f3826791e [BUGFIX] Keep unique values untouched in workspaces (thanks to Benni Mack)
2026-09-04 498d8585aa6 [TASK] Remove irrelevant columns in ColumnSelector (thanks to Georg Ringer)
2026-09-04 cd2a6012925 [BUGFIX] Hand correlation ids to the remaining history writers (thanks to Benni Mack)
2026-09-04 03650f2e890 [BUGFIX] Omit null attributes in media rendering (thanks to Georg Ringer)
2026-09-04 cc30622f15f [BUGFIX] Do not map value types as Extbase relations (thanks to Garvin Hicking)
2026-09-04 01307032aa4 [BUGFIX] Show staged element information only once (thanks to Benjamin Kott)
2026-09-03 2752cf73f9e [BUGFIX] Store language pack state in JSON file (thanks to Andreas Kienast)
2026-09-03 5f11005863e [TASK] Handle client-side errors of workspace dispatcher (thanks to Oliver Hader)
2026-09-03 0a52597a069 [TASK] Remove leftovers of the "pid=-1" workspace marker (thanks to Benni Mack)
2026-09-03 aaabc0bc3c4 [BUGFIX] Show workspace indicator for page translation changes (thanks to Philipp Kitzberger)
2026-09-03 0a5dfacd717 [BUGFIX] Mark blacklisted classes as filtered in debugger (thanks to Wouter Wolters)
2026-09-03 ea724d4f5b5 [BUGFIX] Normalize empty relation values for integer columns (thanks to Benni Mack)
2026-09-03 0b3b9aeae0e [TASK] Streamline PDF page parsing in ext:indexed_search (thanks to Oliver Hader)
2026-09-03 13da05d4db4 [TASK] Add DataScenarios tests for unique value evaluation (thanks to Benni Mack)
2026-09-03 04c6fc71ac6 [TASK] Avoid duplicate scheduler task resolution (thanks to Wouter Wolters)
2026-09-03 47cce17805a [BUGFIX] Avoid PHP error on unresolvable page layout (thanks to Stefan Bürk)
2026-09-03 1a378decdc1 [BUGFIX] Save unsaved parent before following addRecord wizard (thanks to Oliver Bartsch)
2026-09-03 23831a72ff5 [BUGFIX] Allow crop variants without title (thanks to Wouter Wolters)
2026-09-03 28680cb81ed [BUGFIX] Avoid fatal error for unresolvable MountPoint site (thanks to Maike Kiebele)
2026-09-03 a8417d8d759 [TASK] Render workspaces dates via ICU message labels (thanks to Benjamin Franzke)
2026-09-03 d4362e27268 [BUGFIX] Edit single column of page translations again (thanks to Georg Ringer)
2026-09-02 0b4b5293ad5 [BUGFIX] Import page translations onto their parent page (thanks to Benjamin Kott)
2026-09-02 bc090047144 [TASK] Share record identity across backend modules (thanks to Benjamin Kott)
2026-09-02 ef3cddb58eb [TASK] Harden localization wizard endpoints (thanks to Benjamin Kott)
2026-09-02 ed47582d17d [BUGFIX] Catch errors if ini_set is not allowed (thanks to Georg Ringer)
2026-09-02 0238fce6648 [BUGFIX] Do not migrate unrelated history entries on publish (thanks to Benni Mack)
2026-09-02 4545141ab83 [TASK] Update composer.json when downloading extensions from TER (thanks to Benni Mack)
2026-09-02 f3d696bfc66 [TASK] Allow record objects for record icons (thanks to Georg Ringer)
2026-09-02 feee776ff5c [BUGFIX] Avoid endless recursion in workspace dependencies (thanks to Philipp Kitzberger)
2026-09-02 99cee96fb96 [BUGFIX] Render custom columns in the workspaces module (thanks to Benni Mack)
2026-09-02 d927e8e417a [BUGFIX] Order record history creation and deletion lookups (thanks to Benni Mack)
2026-09-02 bfc0e43108a [BUGFIX] Prevent attaching non-object values in ObjectStorageConverter (thanks to Stefan Froemken)
2026-09-02 3446d5c25c5 [TASK] Add autocomplete to setup and language commands (thanks to Georg Ringer)
2026-09-02 03664c68517 [BUGFIX] Correlate workspace stage change and publish history (thanks to Benni Mack)
2026-09-02 eee831ba233 [TASK] Avoid frontend context leak in extbase controller tests (thanks to Benni Mack)
2026-09-02 dea6ed3ab02 [TASK] Raise doctrine/dbal to ~4.4.4 (thanks to Stefan Bürk)
2026-09-02 75963ca60db [BUGFIX] Resolve record history authors by user type (thanks to Benni Mack)
2026-09-02 76b59fc1564 [BUGFIX] Add SQLite JSON and UUID column declarations (thanks to Stefan Bürk)
2026-09-02 38b85060440 [TASK] Improve dashboard DTO types (thanks to Benjamin Franzke)
2026-09-02 e77ff979301 [BUGFIX] Reject indexes over undeclared columns (thanks to Stefan Bürk)
2026-09-02 4eb807f9451 [BUGFIX] Respect language in CategoryBasedFileCollection (thanks to Benni Mack)
2026-09-02 4f53b5a0a70 [BUGFIX] Read all properties of lazily loaded objects (thanks to Benjamin Kott)
2026-09-02 7c1e2f3ca0c [BUGFIX] Ignore enable fields in Extbase overlays (thanks to Benjamin Kott)
2026-09-02 862631bcd80 [BUGFIX] Use one correlation id for a record history rollback (thanks to Benni Mack)
2026-09-02 b684e1b764b [BUGFIX] Skip foreign table query for transOrigPointerField on default language (thanks to Benni Mack)
2026-09-02 cda82504f1a [BUGFIX] Index external files of storages which are not public (thanks to Benni Mack)
2026-09-02 07851cfab0f [BUGFIX] Strip tags from console arguments and options in scheduler task (thanks to Elias Häußler)
2026-09-02 49df547363a [BUGFIX] Limit translation lookup to records page (thanks to Stephan Salzmann)
2026-09-01 659975bc65d [BUGFIX] Do not treat moved records as deleted in record history (thanks to Benni Mack)
2026-09-01 f5c3a265581 [TASK] Add autocomplete to commands of EXT:core (thanks to Tobias Gaertner)
2026-09-01 606dc5f9847 [TASK] Add E2E tests for page creation via page wizard (thanks to Tobias Wojtylak)
2026-09-01 e538548af33 [TASK] Add tests for plugin Startingpoint override (thanks to Stefan Bürk)
2026-09-01 a71e087696e [BUGFIX] Offer a close action after a failed wizard submission (thanks to Benjamin Kott)
2026-09-01 e5fc36d3a0c [TASK] Preserve unicode characters in content of json fields (thanks to Georg Ringer)
2026-09-01 10c5df12aa7 [BUGFIX] Skip inaccessible file references in FileCollector (thanks to Georg Ringer)
2026-09-01 a00feb88e07 [BUGFIX] Make Extbase QueryResult serializable again (thanks to Georg Ringer)
2026-09-01 2c4ba3f7455 [BUGFIX] Ignore diacritics when filtering select fields (thanks to Georg Ringer)
2026-09-01 2fd77665e65 [TASK] Cache resolved site configuration data in core cache (thanks to Benni Mack)
2026-09-01 40e847ef441 [TASK] Pass HTTP basic auth credentials in server response sub-requests (thanks to Georg Ringer)
2026-09-01 2f325123ed9 [BUGFIX] Restrict allowed characters of pages cache tags (thanks to Georg Ringer)
2026-09-01 f458168d88a [TASK] Consider all database fields when querying FAL resources (thanks to Elias Häußler)
2026-09-01 245d787b083 [BUGFIX] Handle backend logo as system resource (thanks to Wouter Wolters)
2026-08-31 9981635a105 [BUGFIX] Handle all PSR-3 log levels in TimeTracker (thanks to Benni Mack)
2026-08-31 6e951326e68 [BUGFIX] Reduce queries when indexing many-to-many relations (thanks to Thomas Prangenberg)
2026-08-31 42f42757902 [TASK] Add missing PATCH HTTP verb @typo3/core/ajax/ajax-request.js (thanks to Benjamin Franzke)
2026-08-31 cd28ed702fe [BUGFIX] Chunk record processing in ReferenceIndex to prevent OOM (thanks to Mikel Wohlschlegel)
2026-08-31 1862afe6f24 [BUGFIX] Make CGL suites work in git worktrees (thanks to Benjamin Kott)
2026-08-31 8a99825e7c4 [BUGFIX] Provide error page to failsafe container (thanks to Stefan Bürk)
2026-08-31 15bb89b3030 [TASK] Update PHPStan to v2.2.10 (thanks to Elias Häußler)
2026-08-31 f0c3da4316d [TASK] Update Fluid Standalone to 5.3.2 (thanks to Simon Praetorius)
2026-08-31 a788c1ed632 [BUGFIX] Allow database names containing a dot in schema migration (thanks to Georg Ringer)
2026-08-31 fdabb6b7ec5 [TASK] Add search query data to AfterPageTreeItemsPreparedEvent (thanks to Benjamin Franzke)
2026-08-28 a3b3767935a [TASK] Add image information to system resources (thanks to Helmut Hummel)
2026-08-28 4c2ded807c5 [BUGFIX] Use correct setting type for page selections in sets (thanks to Georg Ringer)
2026-08-28 1f62bf231f7 [BUGFIX] Escape search term of selectTree filter (thanks to Georg Ringer)
2026-08-27 4b35022a23e [BUGFIX] Fix closing of contextual record edit sheet after refresh (thanks to Oliver Bartsch)
2026-08-27 48548b778ca [BUGFIX] Add a placeholder to the multiselect filter field (thanks to Maike Kiebele)
2026-08-27 d8ba091cf2e [BUGFIX] Use correct access to TSconfig values (thanks to Georg Ringer)
2026-08-27 fe6c85c2bf5 [BUGFIX] Hide password generator without a usable policy (thanks to Benjamin Kott)
2026-08-27 20da0ac79b3 [BUGFIX] Support f:render.text for backend rich text (thanks to Matthias Vogel)
2026-08-27 c239b07b432 [BUGFIX] Use translated option labels in form finisher output (thanks to josuavogel)
2026-08-27 df2a2f13b2d [BUGFIX] Let stdWrap override apply the value "0" (thanks to Benjamin Kott)
2026-08-26 83acc21ed9a [BUGFIX] Delete only own scratch directories in unit tests (thanks to Stefan Bürk)
2026-08-26 b07164ae2cd [BUGFIX] Allow editors to localize root level records (thanks to Georg Ringer)
2026-08-26 c9e17c5b394 [TASK] Use permalinks for documentation URLs (thanks to Elias Häußler)
2026-08-25 3b1930bbf8a [DOCS] Adjust links to project-home for all documentations (thanks to Richard Krikler)
2026-08-25 bbf8d531d4d [BUGFIX] Build a blank form from the blank start template (thanks to Maike Kiebele)
2026-08-25 06dc6292599 [BUGFIX] Fix null access when marking invalid stage items (thanks to Josua Vogel)
2026-08-25 c915a0375d7 [BUGFIX] Reset page renderer when performing subrequest (thanks to Torben Hansen)
2026-08-24 0a2be8c10a7 [TASK] Enrich password generation failed message (thanks to Riccardo De Contardi)
2026-08-24 87fb6ede63c [BUGFIX] Use TypoScript from request in ConfirmationFinisher (thanks to Rafael Kähm)
2026-08-24 6ceccf85b31 [BUGFIX] Use TypoScript from request in CObjectViewHelper (thanks to Rafael Kähm)
2026-08-24 965451aa7dd [TASK] Use the containerised CGL suite in AGENTS.md (thanks to Benjamin Kott)
2026-08-23 e40f1ba8e89 [BUGFIX] Ignore tables that exist as views (thanks to Stefan Bürk)
2026-08-23 ca26e433868 [TASK] Exclude IDE class alias stubs from PHPStan (thanks to Stefan Bürk)
2026-08-23 70092978440 [TASK] Add AGENTS.md with repository guidelines for coding agents (thanks to Benni Mack)
2026-08-21 d67753caf0b [TASK] Make the contextual record edit sheet resizable (thanks to Oliver Bartsch)
2026-08-18 fdef40e2f85 [TASK] Showcase exception display in EXT:styleguide (thanks to Garvin Hicking)
2026-08-18 12c09cb5346 [TASK] Optimize dialog when prompting for BE user language (thanks to Michael Schams)
2026-08-17 142339be605 [DOCS] Update links in SECURITY.md (thanks to Elias Häußler)
2026-08-17 fc7ffa16def [TASK] Test QueryResult with objects instead of arrays (thanks to Oliver Klee)
2026-08-14 d93c6ff8d3c [TASK] Stabilize flaky inline_1n e2e tests (thanks to Stefan Bürk)
2026-08-14 9fd7e47a726 [BUGFIX] Apply intTarget and extTarget to page links (thanks to Anton Danilov)
2026-08-14 922392f57a0 [TASK] Provide shell autocomplete to impexp:export (thanks to Georg Ringer)
2026-08-14 9a7700b49bf [BUGFIX] Mark multi checkbox groups as role="group" (thanks to Sebastian Mendel)
2026-08-14 8dafb3b020e [BUGFIX] Avoid deadlock in console command tests (thanks to Stefan Bürk)
2026-08-13 b358bc24925 [BUGFIX] Cover translation lookup by a single index (thanks to Stefan Bürk)
2026-08-13 230664669f9 [TASK] Stabilize browser based test suites (thanks to Stefan Bürk)
2026-08-13 c3a9c58b8fa [BUGFIX] Add data-use-events to page field wizard button (thanks to Maike Kiebele)
2026-08-12 627949e9dd5 [TASK] Allow guzzlehttp/guzzle v8 to be installed (thanks to Benni Mack)
2026-08-12 bf8e9aa2a86 [BUGFIX] Fix spacing between ratio buttons in image cropper (thanks to Josua Vogel)
2026-08-12 93d59721179 [BUGFIX] Prevent PHP warning on invalid regex in replacement stdWrap (thanks to Georg Ringer)
2026-08-12 531321e8816 [TASK] Remove needless getAccessibleMock() usages (thanks to Benni Mack)
2026-08-11 1833b3cef52 [BUGFIX] Correct handling of page translations in LinkAnalyzerResult (thanks to Juliane)
2026-08-11 deb88b89bff [TASK] Use PHP 8.6 in CI integrity checks (thanks to Stefan Bürk)
2026-08-11 b98f67dfd5f [TASK] Run unit tests with PHP 8.6 (thanks to Stefan Bürk)
2026-08-11 1ac5a89ebea [TASK] Set TYPO3 version to 14.3.7-dev (thanks to Oliver Hader)