You can just file it on the bug tracker at bugs.typo3.org. If its a security issue, send mail to security at typo3.org rather than putting it out there publicly.