CVE-2025-59013: TYPO3 CMS Open Redirect Vulnerability
Summary
CVE-2025-59013: TYPO3 CMS has an open‑redirect vulnerability. Affects typo3/cms-core across 5 version ranges.
>= 9.0.0, < 12.4.37
>= 10.0.0, < 12.4.37
>= 11.0.0, < 12.4.37
>= 12.0.0, < 12.4.37
>= 13.0.0, < 13.4.18
Fixed in 12.4.37 or 13.4.18, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is a widely used open-source content management system (CMS) that enables users to create and manage digital content efficiently. It offers a robust framework for building websites and applications, featuring extensive customization options, user management, and a rich ecosystem of extensions. However, certain versions of TYPO3 CMS are vulnerable to an open redirect issue, which can be exploited by attackers to redirect users to malicious external sites.
Vulnerability Detail
The vulnerability, identified as CVE-2025-59013, arises from an open redirect flaw in the GeneralUtility::sanitizeLocalUrl function of TYPO3 CMS. This issue affects versions 9.0.0 to 9.5.54, 10.0.0 to 10.4.53, 11.0.0 to 11.5.47, 12.0.0 to 12.4.36, and 13.0.0 to 13.4.17. Attackers can exploit this vulnerability by manipulating sanitized URLs, allowing them to redirect users to arbitrary external sites. This can facilitate phishing attacks, posing significant risks to users' security and privacy.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 12.4.3712.4.37composer require typo3/cms-core:12.4.37 -
>= 10.0.0, < 12.4.3712.4.37composer require typo3/cms-core:12.4.37 -
>= 11.0.0, < 12.4.3712.4.37composer require typo3/cms-core:12.4.37 -
>= 12.0.0, < 12.4.3712.4.37composer require typo3/cms-core:12.4.37 -
>= 13.0.0, < 13.4.1813.4.18composer require typo3/cms-core:13.4.18
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can implement strict validation of URLs before redirection to ensure they do not point to external sites. This can be done by checking the URL against a whitelist of allowed domains.
Conclusion
CVE-2025-59013 represents a significant security concern for TYPO3 CMS users, allowing attackers to exploit an open redirect vulnerability. It is crucial for users to update their installations to the latest patched versions to mitigate this risk and protect their users from potential phishing attacks.
See every vulnerability recorded for typo3/cms-core →
FAQ
An open redirect vulnerability allows an attacker to redirect users from a legitimate site to a malicious site, often used for phishing attacks.
Versions 9.0.0 to 9.5.54, 10.0.0 to 10.4.53, 11.0.0 to 11.5.47, 12.0.0 to 12.4.36, and 13.0.0 to 13.4.17 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The primary risk is that attackers can redirect users to malicious sites, leading to potential phishing attacks and compromising user data.
It is recommended to regularly check for updates and apply them promptly to ensure your installation is secure against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
