Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Packagist package

typo3/cms-redirects

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.3PackagistPublished

    TYPO3 CMS Allows Broken Access Control in Redirects Module

    CVE-2025-59021 · GHSA-6c46-p6j5-3f49

    Affected
    • Packagist typo3/cms-redirects >= 14.0.0, <= 14.0.1; >= 13.0.0, <= 13.4.22; >= 12.0.0, <= 12.4.40; >= 11.0.0, <= 11.5.48; >= 10.0.0, <= 10.4.54
    Fixed in
    11.5.4910.4.5513.4.2314.0.212.4.41· Vendor fix available
    Issue
    Problem Backend users with access to the redirects module and write permission on the sysredirect table were able to read, create, and modify any redirect record - without restriction to the user’s own file‑mounts or web‑mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs - facilitating phishing or other malicious redirect attacks. Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. Credits Thanks to Georg Dümmler for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. References TYPO3-CORE-SA-2026-002

    Recommended action: Upgrade to 14.0.2, 13.4.23, 12.4.41 or 2 more by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →