TYPO3 9.5.8

Release Notes

Version 9.5.8

Stay secure and up-to-date with TYPO3 ELTS!

The TYPO3 CMS community supported from 2018-10-02 until 2021-09-30.
Extend your support now until 2024-09-30 to get access to the latest security and compatibility updates for this version.

Learn more about TYPO3 ELTS Browse the TYPO3 ELTS Portal

Release Notes for TYPO3 CMS 9.5.8

This document contains information about TYPO3 CMS 9.5.8 which was released on 25.06.2019.

Get TYPO3 9.5.8 now

Checksums of TYPO3 9.5.8


e63b00ef074cba6afc098b307e5f4f0254c66a604cadba2c91755719a717cff2 typo3_src-9.5.8.tar.gz
28fd2f3bc7a25aaa7c540b559f9584157abe476e163c555856f1e9995d616447 typo3_src-9.5.8.zip


6a1151620e53e29bc20a04e86b0985b0bf23fe77 typo3_src-9.5.8.tar.gz
0009c41d2ea6fb1ba1d0df6405acb51ea59571cd typo3_src-9.5.8.zip


51191a04af5437bed06aed00a5611449 typo3_src-9.5.8.tar.gz
4d2d0c98247f57d8082a49cea710c105 typo3_src-9.5.8.zip

Package Signatures

TYPO3 Release Packages (the downloadable tarballs and zip files) as well as Git tags are signed using PGP signatures during the automated release process. Besides that, MD5 and SHA2-256 hashes are being generated for these files. Find more details on verifying signatures and hashes in the infrastructure guide.

Download GPG signed release README.md file

Example of verifying integrity of tar.gz package of current release:

wget --content-disposition https://get.typo3.org/9.5.8/tar.gz
wget --content-disposition https://get.typo3.org/9.5.8/tar.gz.sig
gpg --verify typo3_src-9.5.8.tar.gz.sig typo3_src-9.5.8.tar.gz


Some security fixes can be considered as breaking changes in order to apply strong security defaults. Please read the security bulletins carefully - manual adjustments concerning backward compatibility are described there as well.

Otherwise, the usual upgrading procedure applies. No database updates are necessary. It might be required to clear all caches; the "important actions" section in the TYPO3 Install Tool offers the accordant possibility to do so.


Here is a list of what was fixed since 9.5.7:

  • 2019-06-25 16a8bcabe4 [RELEASE] Release of TYPO3 9.5.8 (thanks to Benni Mack)
  • 2019-06-25 555e0dd2b2 [SECURITY] Disallow insecure deserialization for l18n_diffsource (thanks to Oliver Hader)
  • 2019-06-25 802e0567a0 [SECURITY] Deny pages' TSconfig and tsconfig_includes for non-admins (thanks to Oliver Hader)
  • 2019-06-25 9ce811c652 [!!!][SECURITY] Disallow session data transfer on frontend user logout (thanks to Oliver Hader)
  • 2019-06-25 df33c7ee3a [SECURITY] Deny access to import module for non-admin users (thanks to Oliver Hader)
  • 2019-06-25 e355cd97bc [SECURITY] Conflict insecure versions symfony/cache component (thanks to Frank Naegler)
  • 2019-06-25 6dcbf981f8 [SECURITY] Disallow javascript & data scheme in URL link handler (thanks to Oliver Hader)
  • 2019-06-25 41e4afb5d6 [SECURITY] Check record permissions in record information popup (thanks to Andreas Fernandez)
  • 2019-06-24 44fe499217 [BUGFIX] Remove caches for page title and meta tag (thanks to Helmut Hummel)
  • 2019-06-24 3c2e517373 [BUGFIX] Fix comment in ViewHelper action.link (thanks to Joerg Kummer)
  • 2019-06-21 5c81be0f01 [TASK] Rename "view helper" to "ViewHelper" (thanks to Daniel Siepmann)
  • 2019-06-21 cfab7cc08a [TASK] Update symfony components (thanks to Benni Mack)
  • 2019-06-19 022b0de9f9 [BUGFIX] Speed up SiteConfiguration loading (thanks to Benni Mack)
  • 2019-06-19 eb8842b871 [BUGFIX] Use proper configuration when processing FlexForms in DataHandler (thanks to Benni Mack)
  • 2019-06-19 fa73763abc [BUGFIX] Add additional GetVars to workspace preview url (thanks to Devid Messner)
  • 2019-06-18 02efc2c224 [BUGFIX] Fix comment in ViewHelper page.link (thanks to Sybille Peters)
  • 2019-06-17 2b9721699d [BUGFIX] Improve wording in Install Tool (thanks to Jonas Eberle)
  • 2019-06-17 c62ae81fac [TASK] Update doctrine/dbal to ^2.8.1 (thanks to Manuel Selbach)
  • 2019-06-14 79825a691e [BUGFIX] t3editor: Harden some checks for TS parsing (thanks to Andreas Fernandez)
  • 2019-06-14 b36be53157 [BUGFIX] Fix page caching with tree.rootLineIds condition check (thanks to Dmytro Nozdrin)
  • 2019-06-14 4c44675133 [TASK] Create Redirect instead of silently ignoring superfluous cHash (thanks to Benni Mack)
  • 2019-06-13 4d1c1604eb [BUGFIX] Allow same configuration key in multiple extensions (thanks to Jonas Eberle)
  • 2019-06-13 0567ec3b1e [BUGFIX] Ignore cHash when given but not needed (thanks to Benni Mack)
  • 2019-06-12 d13b2f3d14 [TASK] Update composer root version for Bamboo builds (thanks to Andreas Fernandez)
  • 2019-06-09 e85c77c732 [BUGFIX] Allow adding content without page edit permissions in record list (thanks to Andreas Fernandez)
  • 2019-06-09 1703accac1 [BUGFIX] Allow adding content without page edit permissions (thanks to Helmut Hummel)
  • 2019-06-07 7829873b56 [BUGFIX] Ensure "0" is treated as proper fallback in site language (thanks to Benni Mack)
  • 2019-06-07 edf32576fe [TASK] Improve click behavior of the pagetree (thanks to Alexander Stehlik)
  • 2019-06-05 8b01570bc7 [BUGFIX] Prevent division by zero when scaling image (thanks to Claus Due)
  • 2019-06-05 f909644f1e [BUGFIX] Ensure no PHP warning is thrown if legacy code is used (thanks to Benni Mack)
  • 2019-06-04 7791461516 Revert "[BUGFIX] Allow to send multiple HTTP headers with the same name" (thanks to Benni Mack)
  • 2019-06-04 e7df51d1d4 [BUGFIX] Use scheme://host:port of current request resolving error page (thanks to Andreas Fernandez)
  • 2019-05-31 f364ea8fbf [TASK] Raise typo3 icons to 1.9.0 (thanks to Benjamin Kott)
  • 2019-05-31 078f372707 [TASK] Add links to the loaded images in the info module (thanks to c.essl)
  • 2019-05-31 325bbc37b4 [BUGFIX] Do not show message "Allowed file extensions" for internal_type="db" (thanks to c.essl)
  • 2019-05-31 70da4de721 [BUGFIX] Refresh browser cache when ckeditor config or plugins changes (thanks to Rémy DANIEL)
  • 2019-05-31 0d5f68feff [BUGFIX] Clamp "simulateDate" timestamp to minimum 60 seconds (thanks to c.essl)
  • 2019-05-31 a18a72e960 [TASK] Write cleaner FileWriter JSON output (thanks to mkoitka)
  • 2019-05-31 f63f6fa272 [BUGFIX] Allow leading zeros in croncommand (thanks to Tomas Norre Mikkelsen)
  • 2019-05-31 ed5581ba20 [BUGFIX] Add integer type casting to uids in SeparateSysHistoryFromSysLogUpdate wizard (thanks to c.essl)
  • 2019-05-31 383be5e0ae [BUGFIX] Add a unit to the document size in the adminpanel (thanks to c.essl)
  • 2019-05-29 9b6054894b [TASK] Disable interface constructor in NodeFactoryTest (thanks to Anja Leichsenring)
  • 2019-05-27 6c3eb7c7a9 [BUGFIX] Fix several typos in comments (thanks to c.essl)
  • 2019-05-27 8a1e581c55 [BUGFIX] Respect sys_language_uid when fetching records for link browser (thanks to Susanne Moog)
  • 2019-05-24 4aeec26f05 [TASK] Add information on how to create custom workspaces (thanks to GeraSchneider)
  • 2019-05-24 f5503fab50 [BUGFIX] Allow to send multiple HTTP headers with the same name (thanks to Markus Poerschke)
  • 2019-05-24 3521a8eaf4 [BUGFIX] Require jquery before using it when rendering ckeditor (thanks to Andreas Fernandez)
  • 2019-05-24 1fcc4a0939 [BUGFIX] Ensure correct initialization of selectTree value (thanks to Nicole Cordes)
  • 2019-05-22 e34c76db2b [BUGFIX] Respect argument showLabel in AbstractButtonViewHelper (thanks to Georg Ringer)
  • 2019-05-20 ef0991c389 [BUGFIX] Use VersionState constants instead of numbers (thanks to Benni Mack)
  • 2019-05-15 497e1a8c9a [BUGFIX] Ensure correct value for JsonResponse in InstallerController (thanks to Guido Schmechel)
  • 2019-05-15 79b954e3dd [TASK] Set TYPO3 version to 9.5.8-dev (thanks to Benni Mack)