Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/typo3/cms-backend@12.4.37
purl pkg:composer/typo3/cms-backend@12.4.37
Next non-vulnerable version 12.4.41
Latest non-vulnerable version 14.0.2
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-uvfp-uq3t-6ffg
Aliases:
CVE-2025-59020
GHSA-5j7q-wmh7-cqhg
TYPO3 CMS Allows Broken Access Control in Edit Document Controller ### Problem By exploiting the `defVals` parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. ### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. ### Credits Thanks to Daniel Windloff for reporting this issue, and to TYPO3 core & security team member Benjamin Franzke for fixing it. ### References * [TYPO3-CORE-SA-2026-001](https://typo3.org/security/advisory/typo3-core-sa-2026-001)
12.4.41
Affected by 0 other vulnerabilities.
13.4.23
Affected by 0 other vulnerabilities.
14.0.2
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (3)
Vulnerability Summary Aliases
VCID-buz5-hzv3-97hp TYPO3 backend modules have Broken Access Control Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes without having access to the corresponding backend modules. CVE-2025-59017
GHSA-2fhw-2j7m-mr4m
VCID-g8t4-khh5-cqey TYPO3 Bookmark Toolbar vulnerable to denial of service An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar. CVE-2025-59014
GHSA-xrcq-533q-8rxw
VCID-sjs5-c9c4-dfc6 TYPO3 CSV download feature information disclosure Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them. CVE-2025-59019
GHSA-j8vm-7q52-2m2m

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-17T00:08:21.802454+00:00 GitLab Importer Affected by VCID-uvfp-uq3t-6ffg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59020.yml 38.4.0
2026-04-12T01:31:53.670049+00:00 GitLab Importer Affected by VCID-uvfp-uq3t-6ffg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59020.yml 38.3.0
2026-04-07T04:58:44.499668+00:00 GHSA Importer Fixing VCID-sjs5-c9c4-dfc6 https://github.com/advisories/GHSA-j8vm-7q52-2m2m 38.1.0
2026-04-07T04:58:43.981814+00:00 GHSA Importer Fixing VCID-buz5-hzv3-97hp https://github.com/advisories/GHSA-2fhw-2j7m-mr4m 38.1.0
2026-04-07T04:58:43.700439+00:00 GHSA Importer Fixing VCID-g8t4-khh5-cqey https://github.com/advisories/GHSA-xrcq-533q-8rxw 38.1.0
2026-04-03T01:40:50.945275+00:00 GitLab Importer Affected by VCID-uvfp-uq3t-6ffg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59020.yml 38.1.0
2026-04-02T12:42:10.113131+00:00 GitLab Importer Fixing VCID-sjs5-c9c4-dfc6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/typo3/cms-backend/CVE-2025-59019.yml 38.0.0
2026-04-01T12:55:08.383172+00:00 GithubOSV Importer Fixing VCID-buz5-hzv3-97hp https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-2fhw-2j7m-mr4m/GHSA-2fhw-2j7m-mr4m.json 38.0.0
2026-04-01T12:55:04.551119+00:00 GithubOSV Importer Fixing VCID-g8t4-khh5-cqey https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-xrcq-533q-8rxw/GHSA-xrcq-533q-8rxw.json 38.0.0
2026-04-01T12:55:01.487051+00:00 GithubOSV Importer Fixing VCID-sjs5-c9c4-dfc6 https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/09/GHSA-j8vm-7q52-2m2m/GHSA-j8vm-7q52-2m2m.json 38.0.0