CVE-2014-9508

Typo3 Open Redirect In Frontend Rendering

4.3 MediumFix available

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage with links that only contain anchors, allows remote attackers to change URLs to arbitrary domains for those links via unknown vectors.

Exploit likelihood

1.72%Up 0.7 points since Feb 4, 2022

What each source reports

NVD Score used 4.3

Record: CVE-2014-9508
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-59
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-9508
Updated: 2026-11-02

EUVDEUVD-2022-5301 No score

Record: EUVD-2022-5301
Updated: 2026-11-03

GitHub AdvisoriesGHSA-v6xv-rmqc-wcc8 No score

Typo3 Open Redirect In Frontend Rendering

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains.

An attacker could forge a request which modifies anchor only links on the homepage of a TYPO3 installation such that they point to arbitrary domains, if the configuration option config.prefixLocalAnchors is used with any possible value. TYPO3 versions 4.6.x and higher are only affected if the homepage is not a shortcut to a different page. As an additional pre-condition, URL rewriting must be enabled in the web server (which it typically is) when using extensions like realurl or cooluri.

Installations where config.absRefPrefix is additionally set to any value are not affected by this vulnerability.

Example of affected configuration:

config.absRefPrefix =
config.prefixLocalAnchors = all 
page = PAGE 
page.10 = TEXT 
page.10.value = <a href="#skiplinks">Skiplinks</a> 
.htaccess:

RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d 
RewriteCond %{REQUEST_FILENAME} !-l 
RewriteRule .* index.php [L]

Record: GHSA-v6xv-rmqc-wcc8
Weakness: CWE-59
Updated: 2026-11-02

OSVGHSA-v6xv-rmqc-wcc8 No score

Typo3 Open Redirect In Frontend Rendering

The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, allows remote attackers to change URLs to arbitrary domains.

Installations where config.absRefPrefix is additionally set to any value are not affected by this vulnerability.

Example of affected configuration:

config.absRefPrefix =
config.prefixLocalAnchors = all 
page = PAGE 
page.10 = TEXT 
page.10.value = <a href="#skiplinks">Skiplinks</a> 
.htaccess:

RewriteCond %{REQUEST_FILENAME} !-f 
RewriteCond %{REQUEST_FILENAME} !-d 
RewriteCond %{REQUEST_FILENAME} !-l 
RewriteRule .* index.php [L]

Record: GHSA-v6xv-rmqc-wcc8
Weakness: CWE-59
Updated: 2026-11-02

Affected products

typo3

Affected packages

Affected packages
Package	Affected	Fixed
`typo3/cms` Packagist	4.5.0 up to 4.5.39	4.5.39
`typo3/cms` Packagist	4.6.0 up to 6.2.9	6.2.9
`typo3/cms` Packagist	7.0.0 up to 7.0.2	7.0.2
`typo3/cms` Packagist	4.6.0 up to 6.2.9, plus listed versions 6.2.06.2.16.2.26.2.36.2.4 Show 4 moreShow less 6.2.56.2.66.2.76.2.8	6.2.9
`typo3/cms` Packagist	7.0.0 up to 7.0.2, plus listed versions 7.0.1	7.0.2

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9508 is a medium vulnerability (CVSS 4.3) in Typo3, published January 4, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.72%, the 77th percentile. Fixed in typo3/cms 4.5.39.