CVE-2025-59013: TYPO3 CMS has an open‑redirect vulnerability
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
Other sources
TYPO3 CMS has an open‑redirect vulnerability
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 13.4.18 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 12.4.37 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 11.5.48 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 10.4.54 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 9.5.55
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59013?
CVE-2025-59013 is considered a high-severity open-redirect vulnerability that can lead to phishing attacks.
How do I fix CVE-2025-59013?
To fix CVE-2025-59013, update TYPO3 CMS to a version beyond 9.5.54, 10.4.53, 11.5.47, 12.4.36, or 13.4.17 that addresses this vulnerability.
Who is affected by CVE-2025-59013?
CVE-2025-59013 affects TYPO3 CMS versions from 9.0.0 to 13.4.17, specifically versions with the specified range.
What types of attacks can be carried out using CVE-2025-59013?
An attacker can exploit CVE-2025-59013 to redirect users to arbitrary external sites, facilitating phishing attempts.
Is there a workaround for CVE-2025-59013?
There are no specific workarounds; upgrading to a patched version is the recommended mitigation for CVE-2025-59013.