TYPO3 13.4.34—What’s Changed?
Released: August 11, 2026
Update type: Security release
TYPO3 13.4.34 is a security release that addresses a critical local request forgery vulnerability via XSS. The update includes important bug fixes for slug generation, database compatibility with MariaDB 11.4+, workspace handling, and various backend improvements.
Security Fixes
- Local Request Forgery Prevention — Fixed a vulnerability that allowed local Fetch/XHR-based request forgery attacks via Cross-Site Scripting (XSS).
Editing & UX Improvements
- Suggest Wizard Fix — Resolved PCRE regex issues that broke the suggest wizard when encountering line breaks.
- Preview Time Rounding — Simulated preview times are now rounded up to full minutes for better consistency.
- Redirect Integrity Display — Prevented unnecessary “danger” class styling for empty redirect integrity states.
Backend & Administration
- Database Connection Security — Database connection URLs are now properly blinded in the TYPO3 backend to prevent credential exposure.
- Initial Setup Fix — Resolved exceptions that occurred during initial TYPO3 setup with an empty database.
- Workspace Language Synchronization — Improved workspace handling with better language synchronization and translation management.
- File Upload Handling — Streamlined file upload processing in the import/export extension.
Technical Changes
- MariaDB 11.4+ Compatibility — Fixed table option lookup and elevated platform support for MariaDB 11.4+ and newer PostgreSQL versions.
- Doctrine DBAL Updates — Avoided deprecated identifier quoting methods and improved schema introspection API usage.
- Slug Generation for DateTime Fields — Fixed slug generation issues with DateTime fields.
- Extbase Backend Mode — Extbase now correctly ignores enable fields when running in backend context.
- Dependency Updates — Updated DOMPurify to 3.4.13, Guzzle dependencies, christian-riesen/base32 to v2, and PHPUnit to 11.5.56.
- PHP 8.6 Support — Allowed execution with PHP 8.6 in development scripts.