CVE-2025-48206: XSS Vulnerability in nitsan/ns-backup Extension for TYPO3
Summary
CVE-2025-48206: The Backup Plus extension for TYPO3 (ns_backup) allows XSS. Affects nitsan/ns-backup versions < 13.0.1. Fixed in 13.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The nitsan/ns-backup extension for TYPO3 is designed to facilitate backup management within TYPO3 installations. It provides users with the ability to create, manage, and restore backups of their TYPO3 sites. However, this extension has been found to have a critical vulnerability that allows for cross-site scripting (XSS), which can lead to unauthorized actions being performed on behalf of users.
Vulnerability Detail
The vulnerability arises from improper handling of user input within the ns_backup extension, specifically in versions up to 13.0.0. This oversight allows attackers to inject malicious scripts into the application, which can be executed in the context of the user's browser. The ramifications of this vulnerability include the potential for data theft, session hijacking, and unauthorized actions taken on behalf of users, posing a significant security risk.
How To Fix
Minimum fixed version
13.0.1
This is the first release that contains the fix.
composer require nitsan/ns-backup:13.0.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the ns_backup extension until the package can be updated. This can be done by modifying user permissions within TYPO3 to prevent unauthorized users from accessing the backup functionalities.
Conclusion
The nitsan/ns-backup extension for TYPO3 has a critical XSS vulnerability that can compromise user security. It is crucial to update to version 13.0.1 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for nitsan/ns-backup →
FAQ
The vulnerability is a cross-site scripting (XSS) flaw that allows attackers to inject malicious scripts into the application.
Versions up to 13.0.0 of the nitsan/ns-backup extension are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The consequences include data theft, session hijacking, and unauthorized actions performed on behalf of users.
Yes, you can restrict access to the ns_backup extension by modifying user permissions within TYPO3.
Related vulnerabilities
Recent vulnerabilities recorded for nitsan/ns-backup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
