CVE-2026-47347: TYPO3 CMS Open Redirect Vulnerability in Core Utilities
Summary
CVE-2026-47347: TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities. Affects typo3/cms-core across 5 version ranges.
< 10.4.57
>= 11.0.0, < 11.5.51
>= 12.0.0, < 12.4.46
>= 13.0.0, < 13.4.31
>= 14.0.0, < 14.3.3
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system widely used for building and managing websites. It offers a robust framework for developers and a user-friendly interface for content editors. However, it has been found to have a vulnerability in its core utilities that can lead to open redirect attacks, compromising user security.
Vulnerability Detail
The vulnerability arises from the use of the GeneralUtility::sanitizeLocalUrl function, which is intended to restrict URLs to local resources. However, if an attacker manipulates the URL after it has passed the sanitization checks, they can redirect users to malicious external sites. This can facilitate phishing attacks and other malicious activities, putting users' sensitive information at risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 10.4.5710.4.57composer require typo3/cms-core:10.4.57 -
>= 11.0.0, < 11.5.5111.5.51composer require typo3/cms-core:11.5.51 -
>= 12.0.0, < 12.4.4612.4.46composer require typo3/cms-core:12.4.46 -
>= 13.0.0, < 13.4.3113.4.31composer require typo3/cms-core:13.4.31 -
>= 14.0.0, < 14.3.314.3.3composer require typo3/cms-core:14.3.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the patch by updating to the latest version of TYPO3 CMS.
Conclusion
The TYPO3 CMS vulnerability CVE-2026-47347 presents a significant risk due to its potential for open redirect attacks. Users are strongly advised to update their installations to the latest patched versions to ensure security and protect against potential phishing threats.
See every vulnerability recorded for typo3/cms-core →
FAQ
An open redirect vulnerability allows attackers to redirect users from a trusted site to a malicious site, often used for phishing attacks.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
While there are no specific workarounds, it is crucial to plan for an update as soon as possible to mitigate the risk.
If exploited, this vulnerability can lead to phishing attacks, where users are redirected to malicious sites, potentially compromising their sensitive information.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
