CVE-2025-48201: Predictable Resource Location in nitsan/ns-backup Extension for TYPO3
Summary
CVE-2025-48201: The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location. Affects nitsan/ns-backup versions < 13.0.1. Fixed in 13.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nitsan/ns-backup extension for TYPO3 is designed to facilitate the backup and restoration of TYPO3 configurations and data. This extension provides users with an easy way to manage backups, ensuring that critical data can be recovered in case of loss or corruption. However, the extension is vulnerable to a predictable resource location issue, which can expose sensitive backup files to unauthorized access.
Vulnerability Detail
The ns_backup extension through version 13.0.0 for TYPO3 has a Predictable Resource Location vulnerability. This flaw allows unauthenticated remote users to access and download created backups and configuration files. The vulnerability arises from the way backup files are stored and accessed, making it possible for attackers to predict the URLs of these files. If exploited, this could lead to unauthorized access to sensitive information, potentially compromising the integrity and confidentiality of the application.
How To Fix
Minimum fixed version
13.0.1
This is the first release that contains the fix.
composer require nitsan/ns-backup:13.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the backup files by implementing server-level security measures, such as configuring your web server to deny access to specific directories where backups are stored. This can be done by adding rules in your .htaccess file or server configuration to prevent unauthorized access.
Conclusion
The Predictable Resource Location vulnerability in the nitsan/ns-backup extension for TYPO3 poses a significant risk by allowing unauthorized access to sensitive backup files. It is crucial to update to version 13.0.1 or later to mitigate this risk. Additionally, implementing temporary access restrictions can help protect your data until the update is applied.
See every vulnerability recorded for nitsan/ns-backup →
FAQ
The CVSS score of this vulnerability is 8.6, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability could allow unauthorized users to download sensitive backup files, potentially leading to data breaches and loss of confidentiality.
Yes, you can implement server-level security measures to restrict access to backup files as a temporary workaround.
If you cannot update the package immediately, ensure that you have implemented access restrictions to the backup files and plan to update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for nitsan/ns-backup.
