CVE-2015-5956
TYPO3 cross-site scripting (XSS)
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
Exploit likelihood
What each source reports
NVD Score used
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
- Record
CVE-2015-5956- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
- Record
CVE-2015-5956- Updated
- 2026-11-02
EUVDEUVD-2022-3322 No score
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
- Record
EUVD-2022-3322- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-989h-wv8x-933p No score
TYPO3 cross-site scripting (XSS)
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
- Record
GHSA-989h-wv8x-933p- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-989h-wv8x-933p No score
TYPO3 cross-site scripting (XSS)
The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting (XSS) attacks via a base64 encoded data URI, as demonstrated by the (1) returnUrl parameter to show_rechis.php and the (2) redirect_url parameter to index.php.
- Record
GHSA-989h-wv8x-933p- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist |
6.0 up to 6.2.15 | 6.2.15 |
typo3/cmsPackagist |
7.0 up to 7.4.0 | 7.4.0 |
typo3/cmsPackagist |
4.0 to 4.5.40 | None known |
typo3/cmsPackagist |
6.0 up to 6.2.15, plus listed versions 6.2.06.2.16.2.106.2.10-rc16.2.11 Show 11 moreShow less6.2.126.2.136.2.146.2.26.2.36.2.46.2.56.2.66.2.76.2.86.2.9 |
6.2.15 |
typo3/cmsPackagist |
7.0 up to 7.4.0, plus listed versions 7.0.07.0.17.0.27.1.07.2.07.3.07.3.1 |
7.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-5956 is a low vulnerability (CVSS 3.5) in Typo3, published September 16, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.01%, the 80th percentile. Fixed in typo3/cms 6.2.15.
References
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-009
seclists.org/fulldisclosure/2015/Sep/57
securitytracker.com/id/1033551
packetstormsecurity.com/files/133551/Typo3-CMS-6.2.14-4.5.40-Cross-Site-Scripting.html
securityfocus.com/archive/1/536464/100/0/threaded
nvd.nist.gov/vuln/detail/CVE-2015-5956
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2015-5956.yaml