TYPO3 CSV download feature information disclosure

보통 4.3CVE-2025-59019 · GHSA-j8vm-7q52-2m2m · Published 09/09/2025 · updated 17/06/2026

요약

CVE-2025-59019은(는) typo3/cms-backend, typo3/cms-recordlist, typo3 (typo3)에 영향을 주는 보통 (CVSS 4.3) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 0.24%, 전체 취약점의 14.5%보다 높음.
조치: 12.4.37, 13.4.18, 11.5.48 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
typo3/cms-backend Packagist	`≥ 12.0.0, < 12.4.37≥ 13.0.0, < 13.4.18`	`12.4.3713.4.18`
typo3/cms-recordlist Packagist	`≥ 11.0.0, < 12.4.37`	`12.4.37`
typo3 typo3	`≥ 11.0.0, < 11.5.48≥ 12.0.0, < 12.4.37≥ 13.0.0, < 13.4.18`	`11.5.4812.4.3713.4.18`

Description

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2025-59019 · ADVISORY
TYPO3-CMS/backend commit c983415 · WEB
typo3.org/security/advisory/typo3-core-sa-2025-023 · WEB

typo3/cms-backend의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

typo3/cms-backend

Packagist

≥ 12.0.0, < 12.4.37≥ 13.0.0, < 13.4.18

12.4.3713.4.18

typo3/cms-recordlist

Packagist

≥ 11.0.0, < 12.4.37

12.4.37

typo3

≥ 11.0.0, < 11.5.48≥ 12.0.0, < 12.4.37≥ 13.0.0, < 13.4.18

11.5.4812.4.3713.4.18

Description

NVD description

typo3/cms-backend의 다른 취약점

모두 보기 →