GitHub Advisoryadvisory · Packagist

GHSA-j8vm-7q52-2m2m TYPO3 CSV download feature information disclosure

MEDIUM Published 2025-09-09 Modified 2025-09-09 Official page ↗
Aliases
CVE-2025-59019
Ecosystem
Packagist
Packages
typo3/cms-backend, typo3/cms-recordlist
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-200
Reviewed
2025-09-09

Affected packages

• Packagist typo3/cms-backend: >= 12.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-backend: >= 13.0.0, < 13.4.18 → fixed in 13.4.18 • Packagist typo3/cms-recordlist: >= 11.0.0, < 12.4.37 → fixed in 12.4.37

Description

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

Related

Alias · CVE (1)

  • CVE-2025-59019 Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References