PT-2026-2474 · Typo3 · Typo3

Benjamin Franzke + 1 · Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-59020

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions 10.0.0 through 10.4.54 TYPO3 versions 11.0.0 through 11.5.48 TYPO3 versions 12.0.0 through 12.4.40 TYPO3 versions 13.0.0 through 13.4.22 TYPO3 versions 14.0.0 through 14.0.1

Description An issue exists where manipulation of the defVals parameter can bypass field-level access checks during record creation within the TYPO3 backend. Successful exploitation allows attackers to insert arbitrary data into restricted fields of a database table, provided the user already possesses write permissions for a limited set of fields.

Recommendations TYPO3 versions 10.0.0 through 10.4.54 should be updated. TYPO3 versions 11.0.0 through 11.5.48 should be updated. TYPO3 versions 12.0.0 through 12.4.40 should be updated. TYPO3 versions 13.0.0 through 13.4.22 should be updated. TYPO3 versions 14.0.0 through 14.0.1 should be updated.

Fix

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-59020

GHSA-5J7Q-WMH7-CQHG

Affected Products

Typo3

References · 11

• https://github.com/TYPO3/typo3/commit/fb98378a8fd30dd50d89a3d1a420780819f38232 · Patch
• https://github.com/TYPO3/typo3/commit/cd11a19958d823d12d028f9345b41739c7e70118 · Patch
• https://github.com/TYPO3/typo3/commit/ac3f792bd5ab7c58153fc1075cb9e001c9cebe3b · Patch
• https://osv.dev/vulnerability/GHSA-5j7q-wmh7-cqhg · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59020 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2026-001 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59020 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-5j7q-wmh7-cqhg · Note
• https://twitter.com/VulmonFeeds/status/2011060286136971568 · Twitter Post
• https://twitter.com/CVEnew/status/2011054598027428204 · Twitter Post