CVE-2025-59019: TYPO3 CMS Backend and Recordlist Information Disclosure via CSV Download Feature
Summary
CVE-2025-59019: TYPO3 CSV download feature information disclosure. Affects typo3/cms-backend across 2 version ranges.
>= 12.0.0, < 12.4.37
>= 13.0.0, < 13.4.18
Fixed in 12.4.37 or 13.4.18, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) widely used for building and managing websites. It offers a robust backend interface for users to manage content, including features for database interaction. However, certain versions of TYPO3 CMS have a vulnerability that allows unauthorized access to sensitive information through the CSV download feature, potentially exposing data from arbitrary database tables.
Vulnerability Detail
The vulnerability arises from missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0 to 11.5.47, 12.0.0 to 12.4.36, and 13.0.0 to 13.4.17. This flaw allows backend users to download CSV files containing data from database tables they do not have permission to access, leading to potential information disclosure. The issue is classified under CWE-200, indicating improper handling of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.4.3712.4.37composer require typo3/cms-backend:12.4.37 -
>= 13.0.0, < 13.4.1813.4.18composer require typo3/cms-backend:13.4.18
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the CSV download feature for backend users until the package is updated. This can be done by modifying user permissions in the TYPO3 backend settings.
Conclusion
CVE-2025-59019 is a significant vulnerability in TYPO3 CMS that can lead to unauthorized information disclosure through the CSV download feature. It is crucial for users of affected versions to update their packages promptly to mitigate potential risks.
See every vulnerability recorded for typo3/cms-backend →
FAQ
CVE-2025-59019 is a vulnerability in TYPO3 CMS that allows unauthorized access to sensitive information through the CSV download feature.
The affected versions include TYPO3 CMS 11.0.0 to 11.5.47, 12.0.0 to 12.4.36, and 13.0.0 to 13.4.17.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability can lead to unauthorized disclosure of sensitive data from database tables that users should not have access to, potentially compromising user privacy and data security.
If immediate updates are not possible, consider restricting access to the CSV download feature and review user permissions to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
