PT-2026-2476 · Typo3 · Typo3/Cms

Daniel Windloff + 2 · Published 2026-01-13 · Updated 2026-01-13 · CVE-2025-59022

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 10.0.0 through 10.4.54 TYPO3 CMS versions 11.0.0 through 11.5.48 TYPO3 CMS versions 12.0.0 through 12.4.40 TYPO3 CMS versions 13.0.0 through 13.4.22 TYPO3 CMS versions 14.0.0 through 14.0.1

Description Backend users with access to the recycler module could delete arbitrary data from any database table defined in the TCA, irrespective of their permissions for that specific table. This allowed attackers to purge and destroy critical site data, potentially rendering the website unavailable. The issue concerns the TYPO3 CMS recycler module and its interaction with the TCA (TypoScript Configuration Array).

Recommendations TYPO3 CMS versions 10.0.0 through 10.4.54 should be updated to a newer, fixed version. TYPO3 CMS versions 11.0.0 through 11.5.48 should be updated to a newer, fixed version. TYPO3 CMS versions 12.0.0 through 12.4.40 should be updated to a newer, fixed version. TYPO3 CMS versions 13.0.0 through 13.4.22 should be updated to a newer, fixed version. TYPO3 CMS versions 14.0.0 through 14.0.1 should be updated to a newer, fixed version.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-59022

GHSA-P52W-7RHW-9M67

Affected Products

Typo3/Cms

References · 12

• https://github.com/TYPO3/typo3/commit/efb9528f9882ac924c40598ebd8508479e9950a3 · Patch
• https://github.com/TYPO3/typo3/commit/336d6f165458a0ce32d8330999ab9ab6a5983d20 · Patch
• https://github.com/TYPO3/typo3/commit/a6604db66499710f72ae6e7006beb14ad0913aae · Patch
• https://typo3.org/security/advisory/typo3-core-sa-2026-003 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-59022 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-59022 · Security Note
• https://osv.dev/vulnerability/GHSA-p52w-7rhw-9m67 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-p52w-7rhw-9m67 · Note
• https://twitter.com/CVEnew/status/2011054596181930163 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2011055166036877575 · Twitter Post
• https://twitter.com/_cvereports/status/2011182225673298414 · Twitter Post