CVE-2025-47936: TYPO3 CMS Webhooks SSRF Vulnerability
Summary
CVE-2025-47936: TYPO3 CMS Webhooks Server Side Request Forgery. Affects typo3/cms-webhooks across 2 version ranges.
>= 12.0.0, < 12.4.31
>= 13.0.0, < 13.4.12
Fixed in 12.4.31 or 13.4.12, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that enables users to create and manage websites efficiently. It is widely used for its flexibility, scalability, and extensive features, including webhooks for integrating with external services. However, the webhooks functionality can be exploited if not properly secured, leading to potential security risks.
Vulnerability Detail
The vulnerability in TYPO3's webhooks arises from their inherent susceptibility to Server-Side Request Forgery (SSRF). This allows attackers, particularly those with administrator-level access, to send crafted requests that can target internal resources, such as localhost or other services on the local network. While TYPO3 itself is not flawed, this vulnerability can enable unauthorized access to systems that would otherwise remain protected.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.4.3112.4.31composer require typo3/cms-webhooks:12.4.31 -
>= 13.0.0, < 13.4.1213.4.12composer require typo3/cms-webhooks:13.4.12
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate SSRF risks, explicitly allow access only to trusted hosts by configuring the allowlist in your TYPO3 settings. Add the following code to your TYPO3 configuration: $GLOBALS['TYPO3_CONF_VARS']['HTTP']['allowed_hosts']['webhooks'] = ['trusted-host.com'];. If the allowlist is not defined or set to null, all requests will be allowed, which is not recommended.
Conclusion
The TYPO3 CMS webhooks vulnerability (CVE-2025-47936) poses a risk of SSRF, allowing unauthorized access to internal resources. It is crucial to update to the latest patched versions and configure the allowed hosts to mitigate this risk effectively.
See every vulnerability recorded for typo3/cms-webhooks →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources.
An attacker with an administrator-level backend user account can exploit this vulnerability to access internal resources.
The risks include unauthorized access to internal systems, which could lead to data breaches or further exploitation of the network.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 3.3, indicating a low severity level.
