PT-2025-22373 · Typo3 · Ns Backup

Published 2025-05-20 · Updated 2025-12-27 · CVE-2025-48204

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ns backup extension for TYPO3 versions through 13.0.0

Description The issue allows command injection when creating a backup. An authenticated backend user with access to the extension's backend module is required to exploit this issue.

Recommendations For versions through 13.0.0, update to a version that contains a fix for this issue to prevent command injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

OS Command Injection

Weakness Enumeration

CWE-79

CWE-78

Related Identifiers

BDU:2025-05999

CVE-2025-48204

GHSA-463C-JHP2-4MM7

Affected Products

Ns Backup

References · 9

• https://osv.dev/vulnerability/GHSA-463c-jhp2-4mm7 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05999 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-48204 · Security Note
• https://github.com/nitsan-technologies/ns_backup/commit/67b8102a19e8e516dc4228f5c42f9e4fba5046cb · Note
• https://github.com/nitsan-technologies/ns_backup · Note
• https://twitter.com/SecAideInfo/status/1926219963322307014 · Twitter Post
• https://t.me/cvetracker/24385 · Telegram Post
• https://typo3.org/security/advisory/typo3-ext-sa-2025-007 · Note
• https://twitter.com/CVEnew/status/2005031813496836259 · Twitter Post