CVE-2026-47347
TYPO3 CMS - Open Redirect in Core Utilities
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
TYPO3 CMS - Open Redirect in Core Utilities
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
- Record
CVE-2026-47347- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
EUVDEUVD-2026-35394
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
- Record
EUVD-2026-35394- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3p42-w5ch-gg42
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
Problem
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks.
Solution
Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.
Credits
TYPO3 CMS thanks Alexandre Romao for reporting this issue, and TYPO3 core & security team member Benjamin Franzke for fixing it.
Resources
- Record
GHSA-3p42-w5ch-gg42- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
NVD
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
- Record
CVE-2026-47347- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-601
- Updated
- 2026-11-02
OSV
TYPO3 CMS - Open Redirect in Core Utilities
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
- Record
CVE-2026-47347- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-11
OSVGHSA-3p42-w5ch-gg42
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
Problem
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks.
Solution
Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.
Credits
TYPO3 CMS thanks Alexandre Romao for reporting this issue, and TYPO3 core & security team member Benjamin Franzke for fixing it.
Resources
- Record
GHSA-3p42-w5ch-gg42- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N - Weakness
- CWE-601
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
before 10.4.57 | 10.4.57 |
typo3/cms-corePackagist |
11.0.0 up to 11.5.51 | 11.5.51 |
typo3/cms-corePackagist |
12.0.0 up to 12.4.46 | 12.4.46 |
typo3/cms-corePackagist |
13.0.0 up to 13.4.31 | 13.4.31 |
typo3/cms-corePackagist |
14.0.0 up to 14.3.3 | 14.3.3 |
typo3/cms-corePackagist |
before 10.4.57, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1v10.2.2 Show 45 moreShow lessv10.3.0v10.4.0v10.4.1v10.4.10v10.4.11v10.4.12v10.4.13v10.4.14v10.4.15v10.4.16v10.4.17v10.4.18v10.4.19v10.4.2v10.4.20v10.4.21v10.4.22v10.4.23v10.4.24v10.4.25v10.4.26v10.4.27v10.4.28v10.4.29v10.4.3v10.4.30v10.4.31v10.4.32v10.4.33v10.4.34v10.4.36v10.4.37v10.4.4v10.4.5v10.4.6v10.4.7v10.4.8v10.4.9v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16 |
10.4.57 |
typo3/cms-corePackagist |
11.0.0 up to 11.5.51, plus listed versions v11.0.0v11.1.0v11.1.1v11.2.0v11.3.0 Show 45 moreShow lessv11.3.1v11.3.2v11.3.3v11.4.0v11.5.0v11.5.1v11.5.10v11.5.11v11.5.12v11.5.13v11.5.14v11.5.15v11.5.16v11.5.17v11.5.18v11.5.19v11.5.2v11.5.20v11.5.21v11.5.22v11.5.23v11.5.24v11.5.25v11.5.26v11.5.27v11.5.28v11.5.29v11.5.3v11.5.30v11.5.31v11.5.32v11.5.33v11.5.34v11.5.35v11.5.36v11.5.37v11.5.38v11.5.39v11.5.4v11.5.40v11.5.41v11.5.5v11.5.6v11.5.7v11.5.8 |
11.5.51 |
typo3/cms-corePackagist |
12.0.0 up to 12.4.46, plus listed versions v12.0.0v12.1.0v12.1.1v12.1.2v12.1.3 Show 45 moreShow lessv12.2.0v12.3.0v12.4.0v12.4.1v12.4.10v12.4.11v12.4.12v12.4.13v12.4.14v12.4.15v12.4.16v12.4.17v12.4.18v12.4.19v12.4.2v12.4.20v12.4.21v12.4.22v12.4.23v12.4.24v12.4.25v12.4.26v12.4.27v12.4.28v12.4.29v12.4.3v12.4.30v12.4.31v12.4.32v12.4.33v12.4.34v12.4.35v12.4.36v12.4.37v12.4.38v12.4.39v12.4.4v12.4.40v12.4.41v12.4.42v12.4.43v12.4.44v12.4.45v12.4.5v12.4.6 |
12.4.46 |
typo3/cms-corePackagist |
13.0.0 up to 13.4.31, plus listed versions v13.0.0v13.0.1v13.1.0v13.1.1v13.2.0 Show 34 moreShow lessv13.2.1v13.3.0v13.3.1v13.4.0v13.4.1v13.4.10v13.4.11v13.4.12v13.4.13v13.4.14v13.4.15v13.4.16v13.4.17v13.4.18v13.4.19v13.4.2v13.4.20v13.4.21v13.4.22v13.4.23v13.4.24v13.4.25v13.4.26v13.4.27v13.4.28v13.4.29v13.4.3v13.4.30v13.4.4v13.4.5v13.4.6v13.4.7v13.4.8v13.4.9 |
13.4.31 |
typo3/cms-corePackagist |
14.0.0 up to 14.3.3, plus listed versions v14.0.0v14.0.1v14.0.2v14.1.0v14.1.1 Show 4 moreShow lessv14.2.0v14.3.0v14.3.1v14.3.2 |
14.3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-47347 is a medium vulnerability (CVSS 5.3) in Typo3 Cms, published June 9, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 22nd percentile. Fixed in typo3/cms-core 10.4.57.
References
typo3.org/security/advisory/typo3-core-sa-2026-009
github.com/TYPO3/typo3/commit/3ffc0835012c6199db0e1dc4b56a77147d8600e0
nvd.nist.gov/vuln/detail/CVE-2026-47347
Left out here: 64 versions. The JSON record has them.