PT-2026-2475 · Typo3 · Typo3/Cms

Elias Häußler + 1 · Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-59021

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 10.0.0 through 10.4.54 TYPO3 CMS versions 11.0.0 through 11.5.48 TYPO3 CMS versions 12.0.0 through 12.4.40 TYPO3 CMS versions 13.0.0 through 13.4.22 TYPO3 CMS versions 14.0.0 through 14.0.1

Description Users with backend access to the redirects module and write permission on the sys redirect table could read, create, and modify any redirect record without restrictions. This allowed for the insertion or alteration of redirects pointing to arbitrary URLs, potentially enabling phishing or other malicious redirect attacks.

Recommendations TYPO3 CMS versions 10.0.0 through 10.4.54 should be updated. TYPO3 CMS versions 11.0.0 through 11.5.48 should be updated. TYPO3 CMS versions 12.0.0 through 12.4.40 should be updated. TYPO3 CMS versions 13.0.0 through 13.4.22 should be updated. TYPO3 CMS versions 14.0.0 through 14.0.1 should be updated.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-59021

GHSA-6C46-P6J5-3F49

Affected Products

Typo3/Cms

References · 11

• https://github.com/TYPO3/typo3/commit/bac370df5c1c3fcf5ebc1c030fbd2bec86d6a686 · Patch
• https://github.com/TYPO3/typo3/commit/8a46abd8993e3a5a31a834dcd6c8f91adef57ce4 · Patch
• https://github.com/TYPO3/typo3/commit/fbbae3b9a40d0420207ef7af990cdf1ac0612c0b · Patch
• https://osv.dev/vulnerability/CVE-2025-59021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59021 · Security Note
• https://osv.dev/vulnerability/GHSA-6c46-p6j5-3f49 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2026-002 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-6c46-p6j5-3f49 · Note
• https://twitter.com/VulmonFeeds/status/2011057726231580736 · Twitter Post
• https://twitter.com/CVEnew/status/2011054597167575108 · Twitter Post