CVE-2025-59016

Information Disclosure via File Abstraction Layer

State: Published
Severity: 5.3 Medium
Published: Sep 9, 2025
Updated: Sep 9, 2025
Reserved: Sep 7, 2025

Description

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.

Scores

CVSS	Score	Vector	Source
4.0	5.3 Medium	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	TYPO3

Weaknesses

CWE-209 Generation of Error Message Containing Sensitive Information

Affected Products

Product	Versions
TYPO3 CMSTYPO3	9.0.0 to before 9.5.55Affected 10.0.0 to before 10.4.54Affected 11.0.0 to before 11.5.48Affected 12.0.0 to before 12.4.37Affected 13.0.0 to before 13.4.18Affected

References

https://typo3.org/security/advisory/typo3-core-sa-2025-020vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.