CVE-2025-59013

Open Redirect in TYPO3 CMS

State: Published
Severity: 5.3 Medium
Published: Sep 9, 2025
Updated: Sep 9, 2025
Reserved: Sep 7, 2025

Description

An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N	TYPO3

Weaknesses

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Affected Products

Product	Versions
TYPO3 CMSTYPO3	9.0.0 to before 9.5.55Affected 10.0.0 to before 10.4.54Affected 11.0.0 to before 11.5.48Affected 12.0.0 to before 12.4.37Affected 13.0.0 to before 13.4.18Affected

References

https://typo3.org/security/advisory/typo3-core-sa-2025-017vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.