Low severity2.7NVD Advisory· Published Sep 9, 2025· Updated Jun 17, 2026

CVE-2025-59014

Description

An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
typo3/cms-backendPackagist	>= 11.0.0, < 12.4.37	12.4.37
typo3/cms-backendPackagist	>= 12.0.0, < 12.4.37	12.4.37
typo3/cms-backendPackagist	>= 13.0.0, < 13.4.18	13.4.18

Affected products

ghsa-coords
pkg:composer/typo3/cms-backend
Range: >= 11.0.0, < 12.4.37
TYPO3/Typo32 versions
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*range: >=11.0.0,<11.5.48
- (no CPE)range: 11.0.0

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-xrcq-533q-8rxwghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-59014ghsaADVISORY
typo3.org/security/advisory/typo3-core-sa-2025-018nvdVendor AdvisoryWEB
github.com/TYPO3-CMS/backend/commit/04db7e25de1d3bb2d082ba68f7f974ccd917cc3fghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.176
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000