Information Disclosure in TYPO3 CMS Affects Multiple Versions
CVE-2025-59016

5.3MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
9 September 2025

What is CVE-2025-59016?

A vulnerability exists in the File Abstraction Layer of TYPO3 CMS allowing backend users to access sensitive information through error messages. When low-level file-system operations fail, the system may disclose full file paths. This could lead to potential exposure of critical file information, making it essential for users to take preventive measures, especially if their installations fall within the affected version range. Users are advised to review security advisories and implement necessary updates as part of their cybersecurity practices.

Affected Version(s)

TYPO3 CMS 9.0.0 < 9.5.55

TYPO3 CMS 10.0.0 < 10.4.54

TYPO3 CMS 11.0.0 < 11.5.48

References

https://typo3.org/security/advisory/typo3-core-sa-2025-020
vendor-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitry Petschke
Marc Willmann
Andreas Kienast
JSON
.