CVE-2026-47347: TYPO3 CMS - Open Redirect in Core Utilities
Problem Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks.
Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.
Credits TYPO3 CMS thanks Alexandre Romao for reporting this issue, and TYPO3 core & security team member Benjamin Franzke for fixing it.
Resources TYPO3-CORE-SA-2026-009
Other sources
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 14.3.3 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 13.4.31 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 12.4.46 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 11.5.51 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 10.4.57
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47347?
The severity of CVE-2026-47347 is classified as medium with a CVSS score of 5.3.
How do I fix CVE-2026-47347?
To fix CVE-2026-47347, you should update your TYPO3 CMS to the latest version that addresses this vulnerability.
What type of attack does CVE-2026-47347 enable?
CVE-2026-47347 enables open redirect attacks allowing attackers to redirect users to external malicious content.
Which TYPO3 applications are affected by CVE-2026-47347?
Applications that utilize GeneralUtility::sanitizeLocalUrl for local URL validation are vulnerable to CVE-2026-47347.
When was CVE-2026-47347 published?
CVE-2026-47347 was published on June 9, 2026.