CVE-2025-59014: TYPO3 CMS Bookmark Toolbar Denial of Service Vulnerability
Summary
CVE-2025-59014: TYPO3 Bookmark Toolbar vulnerable to denial of service. Affects typo3/cms-backend across 3 version ranges.
>= 11.0.0, < 12.4.37
>= 12.0.0, < 12.4.37
>= 13.0.0, < 13.4.18
Fixed in 12.4.37 or 13.4.18, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is a widely used open-source content management system that enables users to create and manage digital content efficiently. It offers a range of features including a flexible backend interface, extensive customization options, and robust user management capabilities. However, certain versions of TYPO3 CMS have been found to be vulnerable to a denial of service condition due to an uncaught exception in the Bookmark Toolbar, affecting the stability of the backend user interface.
Vulnerability Detail
The vulnerability arises from an uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0 to 11.5.47, 12.0.0 to 12.4.36, and 13.0.0 to 13.4.17. This flaw allows administrator-level backend users to save manipulated data, which can trigger a denial of service condition, rendering the backend interface unusable. The issue is classified under CWE-248, indicating improper handling of exceptional conditions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 11.0.0, < 12.4.3712.4.37composer require typo3/cms-backend:12.4.37 -
>= 12.0.0, < 12.4.3712.4.37composer require typo3/cms-backend:12.4.37 -
>= 13.0.0, < 13.4.1813.4.18composer require typo3/cms-backend:13.4.18
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict access to the Bookmark Toolbar for backend users until the patch is applied. This can be done by modifying user permissions in the TYPO3 backend settings.
Conclusion
In summary, CVE-2025-59014 presents a significant risk to TYPO3 CMS installations, allowing backend users to cause a denial of service through the Bookmark Toolbar. It is crucial for users to update to the latest patched versions to mitigate this vulnerability and ensure the stability of their backend interface.
See every vulnerability recorded for typo3/cms-backend →
FAQ
CVE-2025-59014 is a vulnerability in TYPO3 CMS that allows backend users to trigger a denial of service condition through the Bookmark Toolbar.
The affected versions are 11.0.0 to 11.5.47, 12.0.0 to 12.4.36, and 13.0.0 to 13.4.17.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your composer.lock file, you can receive real-time alerts. You can also check your application using the Vulert playground at Vulert Scanner.
If immediate updates are not possible, consider restricting access to the Bookmark Toolbar for backend users as a temporary measure.
The vulnerability is classified as moderate, with a CVSS score of 4.0, indicating a potential impact on the usability of the backend interface.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
