CVE-2025-48204: Command Injection Vulnerability in nitsan/ns-backup for TYPO3
Summary
CVE-2025-48204: The Backup Plus extension for TYPO3 (ns_backup) allows command injections. Affects nitsan/ns-backup versions < 13.0.1. Fixed in 13.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The nitsan/ns-backup extension for TYPO3 is designed to facilitate the backup process of TYPO3 installations. It allows users to create backups of their TYPO3 site data and configurations. However, the extension has a critical vulnerability that can be exploited by authenticated users, potentially leading to unauthorized command execution on the server.
Vulnerability Detail
The ns_backup extension through version 13.0.0 for TYPO3 is susceptible to command injection when creating a backup. This vulnerability arises from insufficient input validation, allowing an authenticated backend user with access to the extensions backend module to execute arbitrary commands on the server. If exploited, this could lead to severe consequences, including data loss or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
13.0.1
This is the first release that contains the fix.
composer require nitsan/ns-backup:13.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the ns_backup extension for backend users who do not require it. This can be done by adjusting user permissions in the TYPO3 backend settings to limit access to the backup module.
Conclusion
The command injection vulnerability in the nitsan/ns-backup extension for TYPO3 poses a significant risk to affected installations. It is essential to update to version 13.0.1 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for nitsan/ns-backup →
FAQ
The vulnerability allows authenticated users to execute arbitrary commands on the server due to insufficient input validation in the ns_backup extension.
Any TYPO3 installation using the nitsan/ns-backup extension version 13.0.0 or earlier is at risk.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without requiring any signup.
As a temporary measure, restrict access to the ns_backup extension for users who do not need it to minimize the risk of exploitation.
Yes, Vulert provides a solution that uses composer.lock to monitor and alert for open-source vulnerabilities in your software automatically.
Related vulnerabilities
Recent vulnerabilities recorded for nitsan/ns-backup.
