216.73.216.197

CVE-2025-59021

· Published 13/01/2026 12:15 · Modified 14/01/2026 19:14

Labels: CVE-2025-59021 2026-01-13CVE-2025-59021CWE-862f4fb688c-4412-4426-b4b8-421ecf27b14a

Essential information

Published
13/01/2026 12:15
Modified
14/01/2026 19:14
Author
—
Creator
—
CVSS
5.3 MEDIUM (v3) 5.3 MEDIUM (v4.0)
CISA KEV
No
CWE
—
CVSS vector
—

CVSS metrics

Description

Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs – facilitating phishing or other malicious redirect attacks. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

NVD status

Status
Analyzed — CVE has been recently published to the CVE List and has been received by the NVD.
Source
f4fb688c-4412-4426-b4b8-421ecf27b14a
NVD
View on NVD

Affected products (CPE)

ProductCPE
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
typo3 / typo3 cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

References