CVE-2025-59013

Published: Sep 9, 2025Modified: Jun 17, 2026

5.3

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: f4fb688c-4412-4426-b4b8-421ecf27b14a (Secondary)

Description

An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.

Affected (5)

Products: Typo3: Typo3

Typo3

1 product

Typo3

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Typo3 Typo3	From 10.0.0 to 10.4.54
Typo3 Typo3	From 11.0.0 to 11.5.48
Typo3 Typo3	From 12.0.0 to 12.4.37
Typo3 Typo3	From 13.0.0 to 13.4.18
Typo3 Typo3	From 9.0.0 to 9.5.55

Related CWEs

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (1)

https://typo3.org/security/advisory/typo3-core-sa-2025-017

Source: f4fb688c-4412-4426-b4b8-421ecf27b14a

Vendor Advisory

Timeline

No history available yet.