VulnerableCode Package Details - pkg:composer/typo3/cms-backend@12.4.28

Search for packages

Vulnerability	Summary	Fixed by
VCID-5pry-8rnc-ubbh Aliases: CVE-2025-47941 GHSA-744g-7qm9-hjh9	The TYPO3 CMS Backend has Broken Authentication in Backend MFA ### Problem The multifactor authentication (MFA) dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful authentication. ### Solution Update to TYPO3 versions 12.4.31 LTS, 13.4.12 LTS that fix the problem described. ### Credits Thanks to Jens Jacobsen and Y. Kahveci for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it.	12.4.31 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }} 13.4.12 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-sjs5-c9c4-dfc6 Aliases: CVE-2025-59019 GHSA-j8vm-7q52-2m2m	TYPO3 CSV download feature information disclosure Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.	12.4.37 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} 13.4.18 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-uvfp-uq3t-6ffg Aliases: CVE-2025-59020 GHSA-5j7q-wmh7-cqhg	TYPO3 CMS Allows Broken Access Control in Edit Document Controller ### Problem By exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. ### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. ### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ### References * [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001)	12.4.41 Affected by 0 other vulnerabilities. 13.4.23 Affected by 0 other vulnerabilities. 14.0.2 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-5pry-8rnc-ubbh
Aliases:
CVE-2025-47941
GHSA-744g-7qm9-hjh9

The TYPO3 CMS Backend has Broken Authentication in Backend MFA ### Problem The multifactor authentication (MFA) dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful authentication. ### Solution Update to TYPO3 versions 12.4.31 LTS, 13.4.12 LTS that fix the problem described. ### Credits Thanks to Jens Jacobsen and Y. Kahveci for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it.

12.4.31
Affected by 2 other vulnerabilities.

13.4.12
Affected by 2 other vulnerabilities.

VCID-sjs5-c9c4-dfc6
Aliases:
CVE-2025-59019
GHSA-j8vm-7q52-2m2m

TYPO3 CSV download feature information disclosure Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

12.4.37
Affected by 1 other vulnerability.

13.4.18
Affected by 1 other vulnerability.

VCID-uvfp-uq3t-6ffg
Aliases:
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg

TYPO3 CMS Allows Broken Access Control in Edit Document Controller ### Problem By exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. ### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. ### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ### References * [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001)

12.4.41
Affected by 0 other vulnerabilities.

13.4.23
Affected by 0 other vulnerabilities.

14.0.2
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-17T00:08:21.772892+00:00	GitLab Importer	Affected by	VCID-uvfp-uq3t-6ffg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59020.yml	38.4.0
2026-04-16T23:40:49.788963+00:00	GitLab Importer	Affected by	VCID-sjs5-c9c4-dfc6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59019.yml	38.4.0
2026-04-16T23:29:09.804971+00:00	GitLab Importer	Affected by	VCID-5pry-8rnc-ubbh	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-47941.yml	38.4.0
2026-04-12T01:31:53.636880+00:00	GitLab Importer	Affected by	VCID-uvfp-uq3t-6ffg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59020.yml	38.3.0
2026-04-12T01:01:39.127383+00:00	GitLab Importer	Affected by	VCID-sjs5-c9c4-dfc6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59019.yml	38.3.0
2026-04-12T00:48:50.252123+00:00	GitLab Importer	Affected by	VCID-5pry-8rnc-ubbh	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-47941.yml	38.3.0
2026-04-03T01:40:50.912539+00:00	GitLab Importer	Affected by	VCID-uvfp-uq3t-6ffg	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59020.yml	38.1.0
2026-04-03T01:09:54.200925+00:00	GitLab Importer	Affected by	VCID-sjs5-c9c4-dfc6	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59019.yml	38.1.0
2026-04-03T00:56:50.112797+00:00	GitLab Importer	Affected by	VCID-5pry-8rnc-ubbh	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-47941.yml	38.1.0