PT-2025-22370 · Typo3 · Ns Backup

Published 2025-05-20 · Updated 2025-12-27 · CVE-2025-48201

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ns backup extension for TYPO3 version 13.0.0 and earlier

Description The issue concerns a Predictable Resource Location in the ns backup extension for TYPO3. This allows an unauthenticated remote user to download created backups and configuration files.

Recommendations For versions 13.0.0 and earlier, consider disabling the ns backup extension until a patch is available to prevent unauthenticated access to backups and configuration files.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

BDU:2025-05994

CVE-2025-48201

GHSA-HQ4F-5QJV-FWRG

Affected Products

Ns Backup

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/nitsan/ns-backup/CVE-2025-48201.yaml · Exploit
• https://bdu.fstec.ru/vul/2025-05994 · Security Note
• https://osv.dev/vulnerability/GHSA-hq4f-5qjv-fwrg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48201 · Security Note
• https://t.me/latest_high_impact_cve/2434 · Telegram Post
• https://twitter.com/CVEnew/status/2005031811852677203 · Twitter Post
• https://github.com/nitsan-technologies/ns_backup · Note
• https://twitter.com/CveFindCom/status/1925215121715974153 · Twitter Post
• https://t.me/cvetracker/24382 · Telegram Post
• https://typo3.org/security/advisory/typo3-ext-sa-2025-007 · Note
• https://github.com/nitsan-technologies/ns_backup/commit/67b8102a19e8e516dc4228f5c42f9e4fba5046cb · Note