p PatchFirst

CVE-2025-59019

CVE-2025-59019 · Information Disclosure via CSV Download

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

CVSS 5.3 · Medium · EPSS 0.2% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • typo3 cms

    Versions
    • ≥ 12.0.0, < 12.4.37: Affected (semver)
    • ≥ 13.0.0, < 13.4.18: Affected (semver)

    Update to 12.4.37; Update to 13.4.18

  • typo3 cms

    Versions
    • ≥ 11.0.0, < 11.5.48: Affected (semver)

    Update to 11.5.48

  • typo3/cms-backend Packagist

    Versions
    • v12.0.0
    • v12.1.0
    • v12.1.1
    • v12.1.2
    • v12.1.3
    • v12.2.0
    • v12.3.0
    • v12.4.0
    • v12.4.1
    • v12.4.10
    • v12.4.11
    • v12.4.12
    • v12.4.13
    • v12.4.14
    • v12.4.15
    • v12.4.16
    • v12.4.17
    • v12.4.18
    • v12.4.19
    • v12.4.2
    • v12.4.20
    • v12.4.21
    • v12.4.22
    • v12.4.23
    • v12.4.24
    • v12.4.25
    • v12.4.26
    • v12.4.27
    • v12.4.28
    • v12.4.29
    • v12.4.3
    • v12.4.30
    • v12.4.31
    • v12.4.32
    • v12.4.33
    • v12.4.34
    • v12.4.35
    • v12.4.36
    • v12.4.4
    • v12.4.5
    • v12.4.6
    • v12.4.7
    • v12.4.8
    • v12.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 12.0.0, < 12.4.37

    Update to 12.4.37

  • typo3/cms-backend Packagist

    Versions
    • v13.0.0
    • v13.0.1
    • v13.1.0
    • v13.1.1
    • v13.2.1
    • v13.3.0
    • v13.3.1
    • v13.4.0
    • v13.4.1
    • v13.4.10
    • v13.4.11
    • v13.4.12
    • v13.4.13
    • v13.4.14
    • v13.4.15
    • v13.4.16
    • v13.4.17
    • v13.4.2
    • v13.4.3
    • v13.4.4
    • v13.4.5
    • v13.4.6
    • v13.4.7
    • v13.4.8
    • v13.4.9
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.0, < 13.4.18

    Update to 13.4.18

  • typo3/cms-recordlist Packagist

    Versions
    • v11.0.0
    • v11.1.0
    • v11.1.1
    • v11.2.0
    • v11.3.0
    • v11.3.1
    • v11.3.2
    • v11.3.3
    • v11.4.0
    • v11.5.0
    • v11.5.1
    • v11.5.10
    • v11.5.11
    • v11.5.12
    • v11.5.13
    • v11.5.14
    • v11.5.15
    • v11.5.16
    • v11.5.17
    • v11.5.18
    • v11.5.19
    • v11.5.2
    • v11.5.20
    • v11.5.21
    • v11.5.22
    • v11.5.23
    • v11.5.24
    • v11.5.25
    • v11.5.26
    • v11.5.27
    • v11.5.28
    • v11.5.29
    • v11.5.3
    • v11.5.30
    • v11.5.31
    • v11.5.32
    • v11.5.33
    • v11.5.34
    • v11.5.35
    • v11.5.36
    • v11.5.37
    • v11.5.38
    • v11.5.39
    • v11.5.4
    • v11.5.40
    • v11.5.41
    • v11.5.5
    • v11.5.6
    • v11.5.7
    • v11.5.8
    • v11.5.9
    Affected ranges
    • ECOSYSTEM: ≥ 11.0.0, < 12.4.37

    Update to 12.4.37

Original sources

Check your server →