PT-2025-22141 · Typo3 · Typo3

Hamed Kohi · Published 2025-05-20 · Updated 2025-05-20 · CVE-2025-47939

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions TYPO3 versions 9.0.0 through 9.5.50 ELTS TYPO3 versions 10.0.0 through 10.4.49 ELTS TYPO3 versions 11.0.0 through 11.5.43 ELTS TYPO3 versions 12.0.0 through 12.4.30 LTS TYPO3 versions 13.0.0 through 13.4.11 LTS

Description The file management module in TYPO3's backend user interface allows the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be considered potentially harmful, such as executable binaries or files with inconsistent file extensions and MIME types. Although such files are not directly executable through the web server, their presence can introduce indirect risks, such as third-party services flagging or blocking access to the website for end users if suspicious files are found.

Recommendations Update to TYPO3 version 9.5.51 ELTS to fix the problem. Update to TYPO3 version 10.4.50 ELTS to fix the problem. Update to TYPO3 version 11.5.44 ELTS to fix the problem. Update to TYPO3 version 12.4.31 LTS to fix the problem. Update to TYPO3 version 13.4.12 LTS to fix the problem.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-351

CWE-434

Related Identifiers

BDU:2025-06005

CVE-2025-47939

GHSA-9HQ9-CR36-4WPJ

Affected Products

Typo3

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47939.json · Exploit
• https://github.com/TYPO3/typo3/security/advisories/GHSA-9hq9-cr36-4wpj · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06005 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2025-014 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47939 · Security Note
• https://osv.dev/vulnerability/GHSA-9hq9-cr36-4wpj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-47939 · Vendor Advisory
• https://github.com/TYPO3-CMS/core · Note
• https://github.com/TYPO3-CMS/core/commit/c265beed6e2c01817c534a226e80e593400f8255 · Note
• https://twitter.com/VulmonFeeds/status/1924840975311966609 · Twitter Post
• https://twitter.com/CVEnew/status/1924837282470559759 · Twitter Post
• https://docs.typo3.org/m/typo3/reference-coreapi/main/en-us/ApiOverview/Fal/Index.html · Note