CVE-2005-4875

TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`

7.5 HighFix available

TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the phpinfo function and prints values of unspecified environment variables.

Exploit likelihood

1.38%Up 0.2 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

Record: CVE-2005-4875
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2005-4875
Updated: 2026-11-02

EUVDEUVD-2005-4866 No score

Record: EUVD-2005-4866
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xj84-6q8f-qg2r No score

TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`

Record: GHSA-xj84-6q8f-qg2r
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-xj84-6q8f-qg2r No score

TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`

Record: GHSA-xj84-6q8f-qg2r
Weakness: CWE-200
Updated: 2026-11-02

Affected products

typo3

Affected packages

Affected packages
Package	Affected	Fixed
`typo3/cms` Packagist	before 3.8.1	3.8.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-4875 is a high vulnerability (CVSS 7.5) in Typo3, published December 31, 2005. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.38%, the 72nd percentile. Fixed in typo3/cms 3.8.1.