CVE-2025-30083
Additional TCA Allows Cross-Site Scripting (XSS)
A cross-site scripting (XSS) vulnerability has been discovered in the Additional TCA extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 1.15.17 and 1.16.9 are available for download.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
What each source reports
GitHub Advisories Score usedGHSA-rrh3-cgmx-w62f
Additional TCA Allows Cross-Site Scripting (XSS)
A cross-site scripting (XSS) vulnerability has been discovered in the Additional TCA extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 1.15.17 and 1.16.9 are available for download.
- Record
GHSA-rrh3-cgmx-w62f- CVSS 3.1
- 5.1 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-rrh3-cgmx-w62f
Additional TCA Allows Cross-Site Scripting (XSS)
A cross-site scripting (XSS) vulnerability has been discovered in the Additional TCA extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 1.15.17 and 1.16.9 are available for download.
- Record
GHSA-rrh3-cgmx-w62f- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
codingms/additional-tcaPackagist |
1.16.0 up to 1.16.9 | 1.16.9 |
codingms/additional-tcaPackagist |
1.7.0 up to 1.15.17 | 1.15.17 |
codingms/additional-tcaPackagist |
1.16.0 up to 1.16.9, plus listed versions 1.16.11.16.21.16.31.16.41.16.51.16.61.16.71.16.8 |
1.16.9 |
codingms/additional-tcaPackagist |
1.7.0 up to 1.15.17, plus listed versions 1.10.01.10.11.10.21.11.01.11.1 Show 45 moreShow less1.12.01.12.11.12.21.12.31.12.41.13.01.13.11.14.01.14.11.14.101.14.111.14.121.14.131.14.141.14.151.14.161.14.21.14.31.14.41.14.51.14.61.14.71.14.81.14.91.15.01.15.11.15.101.15.111.15.121.15.131.15.141.15.151.15.161.15.21.15.31.15.41.15.51.15.61.15.71.15.81.15.91.7.11.7.21.7.31.7.4 |
1.15.17 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-30083 is a medium vulnerability (CVSS 5.1) in codingms/additional-tca, published March 19, 2025. No source lists public exploit code. Fixed in codingms/additional-tca 1.16.9.
References
Left out here: 3 versions. The JSON record has them.