If you have found a potential security flaw, please reach out directly to the TYPO3 Security Team. For additional information and guidelines, you can also check out TYPO3's Security Policy.