CVE-2005-4875

TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`

7.5 HighFix available

CVE-2005-4875 is a high vulnerability (CVSS 7.5) in Typo3, published December 31, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in typo3/cms 3.8.1.

TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phpinfo function and prints values of unspecified environment variables.

Exploit likelihood

1.38%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2005-4875
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-4875
Updated: 2026-11-02

EUVDEUVD-2005-4866 No score

Record: EUVD-2005-4866
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xj84-6q8f-qg2r No score

TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`

Record: GHSA-xj84-6q8f-qg2r
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-xj84-6q8f-qg2r No score

TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`

Record: GHSA-xj84-6q8f-qg2r
Weakness: CWE-200
Updated: 2026-11-02

Affected products

typo3

Affected packages

Affected packages
Package	Affected	Fixed
`typo3/cms` Packagist	before 3.8.1	3.8.1

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV