CVE-2024-25120
Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.
- Record
CVE-2024-25120- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2024-0750
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.
- Record
EUVD-2024-0750- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wf85-8hx9-gj7c
TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme
Problem
The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account.
Solution
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
Credits
Thanks to Richie Lee who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue.
References
- Record
GHSA-wf85-8hx9-gj7c- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-284
- Updated
- 2026-11-02
NVD
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.
- Record
CVE-2024-25120- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-284
- Updated
- 2026-11-02
OSV
Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known workarounds for this issue.
- Record
CVE-2024-25120- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-284
- Updated
- 2026-11-02
OSVGHSA-wf85-8hx9-gj7c
TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme
Problem
The TYPO3-specific t3:// URI scheme could be used to access resources outside of the users' permission scope. This encompassed files, folders, pages, and records (although only if a valid link-handling configuration was provided). Exploiting this vulnerability requires a valid backend user account.
Solution
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
Credits
Thanks to Richie Lee who reported this issue and to TYPO3 core & security team member Benjamin Franzke who fixed the issue.
References
- Record
GHSA-wf85-8hx9-gj7c- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist | 8.0.0 to 8.7.56 | 8.7.57 |
typo3/cms-corePackagist | 9.0.0 to 9.5.45 | 9.5.46 |
typo3/cms-corePackagist | 10.0.0 to 10.4.42 | 10.4.43 |
typo3/cms-corePackagist | 11.0.0 to 11.5.34 | 11.5.35 |
typo3/cms-corePackagist | 12.0.0 to 12.4.10 | 12.4.11 |
typo3/cms-corePackagist | 13.0.0 to 13.0.0 | 13.0.1 |
typo3/cms-corePackagist | 8.0.0 up to 8.7.57, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 21 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.30v8.7.31v8.7.32v8.7.7v8.7.8v8.7.9 | 8.7.57 |
typo3/cms-corePackagist | 9.0.0 up to 9.5.46, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 36 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.12v9.5.13v9.5.14v9.5.15v9.5.16v9.5.17v9.5.18v9.5.19v9.5.2v9.5.20v9.5.21v9.5.22v9.5.23v9.5.24v9.5.25v9.5.26v9.5.27v9.5.28v9.5.29v9.5.3v9.5.30v9.5.31v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 | 9.5.46 |
typo3/cms-corePackagist | 10.0.0 up to 10.4.43, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 38 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.19v10.4.2v10.4.20v10.4.21v10.4.22v10.4.23v10.4.24v10.4.25v10.4.26v10.4.27v10.4.28v10.4.29v10.4.3v10.4.30v10.4.31v10.4.32v10.4.33v10.4.34v10.4.36v10.4.37v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9 | 10.4.43 |
typo3/cms-corePackagist | 11.0.0 up to 11.5.35, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0 Show 39 moreShow lessv11.3.1v11.3.2v11.3.3v11.4.0v11.5.0v11.5.1v11.5.10v11.5.11v11.5.12v11.5.13v11.5.14v11.5.15v11.5.16v11.5.17v11.5.18v11.5.19v11.5.2v11.5.20v11.5.21v11.5.22v11.5.23v11.5.24v11.5.25v11.5.26v11.5.27v11.5.28v11.5.29v11.5.3v11.5.30v11.5.31v11.5.32v11.5.33v11.5.34v11.5.4v11.5.5v11.5.6v11.5.7v11.5.8v11.5.9 | 11.5.35 |
typo3/cms-corePackagist | 12.0.0 up to 12.4.11, plus listed versions v12.0.0v12.1.0v12.1.1v12.1.2v12.1.3 Show 13 moreShow lessv12.2.0v12.3.0v12.4.0v12.4.1v12.4.10v12.4.2v12.4.3v12.4.4v12.4.5v12.4.6v12.4.7v12.4.8v12.4.9 | 12.4.11 |
typo3/cms-corePackagist | 13.0.0 up to 13.0.1, plus listed versions v13.0.0 | 13.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-25120 is a medium vulnerability (CVSS 4.3) in Typo3, published February 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.55%, the 46th percentile. Fixed in typo3/cms-core 8.7.57.
References
github.com/TYPO3/typo3/security/advisories/GHSA-wf85-8hx9-gj7c
docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Functions/Typolink.html
typo3.org/security/advisory/typo3-core-sa-2024-005