GitHub Advisoryadvisory · Packagist

GHSA-xrcq-533q-8rxw TYPO3 Bookmark Toolbar vulnerable to denial of service

MEDIUM Published 2025-09-09 Modified 2025-09-09 Official page ↗
Aliases
CVE-2025-59014
Ecosystem
Packagist
Packages
typo3/cms-backend
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-248
Reviewed
2025-09-09

Affected packages

• Packagist typo3/cms-backend: >= 11.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-backend: >= 12.0.0, < 12.4.37 → fixed in 12.4.37 • Packagist typo3/cms-backend: >= 13.0.0, < 13.4.18 → fixed in 13.4.18

Description

An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.

Related

Alias · CVE (1)

  • CVE-2025-59014 An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets… vulnerability

Weakness · CWE (1)

  • CWE-248 Uncaught Exception weakness

References