CVE-2025-59016

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
TYPO3	TYPO3 CMS	>= 9.0.0, < 9.5.55; >= 10.0.0, < 10.4.54; >= 11.0.0, < 11.5.48; >= 12.0.0, < 12.4.37; >= 13.0.0, < 13.4.18

References

https://typo3.org/security/advisory/typo3-core-sa-2025-020Vendor Advisory

Timeline

Published: Sep 9, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590178.8Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and CVE-2025-590186.5Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and CVE-2025-590194.3Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow back CVE-2025-59028.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207 and classified as critical. This issue affects the function setUpgradeFW of the file CVE-2025-590206.5By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave CVE-2025-590216.4Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any r CVE-2025-590228.1Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of w CVE-2025-590238.2Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590246.5Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590256.1Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, includi CVE-2025-590265.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be ex CVE-2025-590287.5When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fai