CVE-2025-48200: Remote Code Execution in sjbr/sr-feuser-register Extension for TYPO3
Summary
CVE-2025-48200: The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution. Affects sjbr/sr-feuser-register versions >= 5.1.0, < 12.5.0. Fixed in 12.5.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sjbr/sr-feuser-register extension for TYPO3 is designed to facilitate user registration on TYPO3-based websites. It provides features such as customizable registration forms and user management. However, the extension has been found to be vulnerable to remote code execution due to unsafe deserialization, which can allow attackers to execute arbitrary code on the server.
Vulnerability Detail
The vulnerability arises from the unsafe deserialization process implemented in the sr_feuser_register extension. This flaw allows an attacker to craft malicious serialized data that, when processed by the application, can lead to remote code execution. The implications of this vulnerability are severe, as it can enable unauthorized access to the server, data manipulation, and potential system compromise. The vulnerability is classified under CWE-502, which pertains to deserialization of untrusted data.
How To Fix
Minimum fixed version
12.5.0
This is the first release that contains the fix.
composer require sjbr/sr-feuser-register:12.5.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you are unable to update the package immediately, consider disabling the sr_feuser_register extension temporarily to mitigate the risk of exploitation until a proper update can be applied.
Conclusion
The sr_feuser_register extension for TYPO3 has a critical vulnerability that allows remote code execution through unsafe deserialization. It is crucial to update to version 12.5.0 or later to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their software dependencies.
See every vulnerability recorded for sjbr/sr-feuser-register →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to gain unauthorized access to the server and manipulate data.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the composer.lock file.
If immediate updates are not possible, consider disabling the sr_feuser_register extension to reduce the risk of exploitation until you can apply the update.
Related vulnerabilities
Recent vulnerabilities recorded for sjbr/sr-feuser-register.
