GHSA-j8vm-7q52-2m2m

TYPO3 CSV download feature information disclosure

At a glance

Published: 2025-09-09 09:31 UTC
Updated: 2025-09-09 20:44 UTC
CVE: CVE-2025-59019
CVSS_V4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Description

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

Affected packages

Package	Versions
Packagist · typo3/cms-backend	introduced 12.0.0, fixed 12.4.37
Packagist · typo3/cms-backend	introduced 13.0.0, fixed 13.4.18
Packagist · typo3/cms-recordlist	introduced 11.0.0, fixed 12.4.37

References

https://nvd.nist.gov/vuln/detail/CVE-2025-59019 ADVISORY
https://github.com/TYPO3-CMS/backend/commit/c983415f062c32f8edbb78544a0ff3219bc35d17 WEB
https://typo3.org/security/advisory/typo3-core-sa-2025-023 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database