CVE-2026-47347: TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS
Problem Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks.
Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.
Credits TYPO3 CMS thanks Alexandre Romao for reporting this issue, and TYPO3 core & security team member Benjamin Franzke for fixing it.
Resources TYPO3-CORE-SA-2026-009
Other sources
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
— MITRE
TYPO3-CORE-SA-2026-009: Open Redirect in TYPO3 CMS
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 14.3.3 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 13.4.31 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 12.4.46 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 11.5.51 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 10.4.57 - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 10.4.57Patch TYPO3-CORE-SA-2026-009 - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 11.5.51Patch TYPO3-CORE-SA-2026-009 - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 12.4.46Patch TYPO3-CORE-SA-2026-009 - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 13.4.31Patch TYPO3-CORE-SA-2026-009 - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 14.3.3Patch TYPO3-CORE-SA-2026-009
Event History
Frequently Asked Questions
What is the severity of CVE-2026-47347?
The severity of CVE-2026-47347 is classified as medium with a CVSS score of 5.3.
How do I fix CVE-2026-47347?
To fix CVE-2026-47347, you should update your TYPO3 CMS to the latest version that addresses this vulnerability.
What type of attack does CVE-2026-47347 enable?
CVE-2026-47347 enables open redirect attacks allowing attackers to redirect users to external malicious content.
Which TYPO3 applications are affected by CVE-2026-47347?
Applications that utilize GeneralUtility::sanitizeLocalUrl for local URL validation are vulnerable to CVE-2026-47347.
When was CVE-2026-47347 published?
CVE-2026-47347 was published on June 9, 2026.