GHSA-j8vm-7q52-2m2m

ghsaUSosv

TYPO3 CSV download feature information disclosure

view advisory published 2025-09-09Licence: CC-BY-4.0

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2025-59019US	medium4.3	0.24% (14th)	—	2025-09-09
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from a…

references

External citations — patches, advisories, analysis.

https://github.com/TYPO3-CMS/backend/commit/c983415f062c32f8edbb78544a0ff3219bc35d17WEB
https://nvd.nist.gov/vuln/detail/CVE-2025-59019ADVISORY
https://typo3.org/security/advisory/typo3-core-sa-2025-023WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan