CVE-2021-31777: The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before
Source CVE Database V5
Not known to be exploited · fixed in 2.7.1 : patch affected systems soon.
Data as of 26 Oct 2026, 10:12 UTC
Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA
- EPSS
- 1.4% chance of exploitation in 30 days – higher than 72% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 2.7.1, 2.6.2
Exploitation evidence
Disclosed: evidence found.
CVE published 28 Apr 2021
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | Affected
| Fixed in
|
AI-suggested
Organizations should immediately upgrade the dce extension to version 2.6.2 or 2.7.1 or later, as these versions contain the necessary fixes. In addition, it is critical to audit and restrict backend user accounts to the minimum necessary privileges, enforce strong authentication mechanisms such as multi-factor authentication (MFA), and monitor backend access logs for suspicious activity. Regularly reviewing and rotating credentials can reduce the risk of compromised accounts. Implementing web application firewalls (WAFs) with SQL injection detection rules can provide an additional layer of defense. Conducting security assessments and penetration testing focused on backend access controls and input validation will help identify residual risks. Finally, organizations should maintain an up-to-date inventory of TYPO3 extensions and promptly apply security updates.
Description
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.