CVE-2025-59013
Open Redirect in TYPO3 CMS
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Open Redirect in TYPO3 CMS
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
- Record
CVE-2025-59013- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2025-27232
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
- Record
EUVD-2025-27232- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-72jf-5fg5-3cw3
TYPO3 CMS has an open‑redirect vulnerability
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
- Record
GHSA-72jf-5fg5-3cw3- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
- Record
CVE-2025-59013- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
Open Redirect in TYPO3 CMS
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
- Record
CVE-2025-59013- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
OSVGHSA-72jf-5fg5-3cw3
TYPO3 CMS has an open‑redirect vulnerability
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external sites, enabling phishing attacks by supplying a manipulated, sanitized URL.
- Record
GHSA-72jf-5fg5-3cw3- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
9.0.0 up to 9.5.55 | 9.5.55 |
typo3/cms-corePackagist |
10.0.0 up to 10.4.54 | 10.4.54 |
typo3/cms-corePackagist |
11.0.0 up to 11.5.48 | 11.5.48 |
typo3/cms-corePackagist |
12.0.0 up to 12.4.37 | 12.4.37 |
typo3/cms-corePackagist |
13.0.0 up to 13.4.18 | 13.4.18 |
typo3/cms-corePackagist |
9.0.0 up to 12.4.37, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 45 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.19v10.4.2v10.4.20v10.4.21v10.4.22v10.4.23v10.4.24v10.4.25v10.4.26v10.4.27v10.4.28v10.4.29v10.4.3v10.4.30v10.4.31v10.4.32v10.4.33v10.4.34v10.4.36v10.4.37v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0v11.3.1v11.3.2 |
12.4.37 |
typo3/cms-corePackagist |
10.0.0 up to 12.4.37, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 45 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.19v10.4.2v10.4.20v10.4.21v10.4.22v10.4.23v10.4.24v10.4.25v10.4.26v10.4.27v10.4.28v10.4.29v10.4.3v10.4.30v10.4.31v10.4.32v10.4.33v10.4.34v10.4.36v10.4.37v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0v11.3.1v11.3.2 |
12.4.37 |
typo3/cms-corePackagist |
11.0.0 up to 12.4.37, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0 Show 45 moreShow lessv11.3.1v11.3.2v11.3.3v11.4.0v11.5.0v11.5.1v11.5.10v11.5.11v11.5.12v11.5.13v11.5.14v11.5.15v11.5.16v11.5.17v11.5.18v11.5.19v11.5.2v11.5.20v11.5.21v11.5.22v11.5.23v11.5.24v11.5.25v11.5.26v11.5.27v11.5.28v11.5.29v11.5.3v11.5.30v11.5.31v11.5.32v11.5.33v11.5.34v11.5.35v11.5.36v11.5.37v11.5.38v11.5.39v11.5.4v11.5.40v11.5.41v11.5.5v11.5.6v11.5.7v11.5.8 |
12.4.37 |
typo3/cms-corePackagist |
12.0.0 up to 12.4.37, plus listed versions v12.0.0v12.1.0v12.1.1v12.1.2v12.1.3 Show 39 moreShow lessv12.2.0v12.3.0v12.4.0v12.4.1v12.4.10v12.4.11v12.4.12v12.4.13v12.4.14v12.4.15v12.4.16v12.4.17v12.4.18v12.4.19v12.4.2v12.4.20v12.4.21v12.4.22v12.4.23v12.4.24v12.4.25v12.4.26v12.4.27v12.4.28v12.4.29v12.4.3v12.4.30v12.4.31v12.4.32v12.4.33v12.4.34v12.4.35v12.4.36v12.4.4v12.4.5v12.4.6v12.4.7v12.4.8v12.4.9 |
12.4.37 |
typo3/cms-corePackagist |
13.0.0 up to 13.4.18, plus listed versions v13.0.0v13.0.1v13.1.0v13.1.1v13.2.0 Show 21 moreShow lessv13.2.1v13.3.0v13.3.1v13.4.0v13.4.1v13.4.10v13.4.11v13.4.12v13.4.13v13.4.14v13.4.15v13.4.16v13.4.17v13.4.2v13.4.3v13.4.4v13.4.5v13.4.6v13.4.7v13.4.8v13.4.9 |
13.4.18 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-59013 is a medium vulnerability (CVSS 5.3) in Typo3, published September 9, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.18%, the 8th percentile. Fixed in typo3/cms-core 9.5.55.
References
typo3.org/security/advisory/typo3-core-sa-2025-017
nvd.nist.gov/vuln/detail/CVE-2025-59013
github.com/TYPO3-CMS/core/commit/862b9da870815132c31119cd85bc454a5010793c
packagist.org
Left out here: 262 versions. The JSON record has them.