Medium severity4.3NVD Advisory· Published Sep 9, 2025· Updated Jun 17, 2026
CVE-2025-59019
CVE-2025-59019
Description
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
typo3/cms-backendPackagist | >= 12.0.0, < 12.4.37 | 12.4.37 |
typo3/cms-backendPackagist | >= 13.0.0, < 13.4.18 | 13.4.18 |
typo3/cms-recordlistPackagist | >= 11.0.0, < 12.4.37 | 12.4.37 |
Affected products
3- ghsa-coords2 versions
>= 12.0.0, < 12.4.37+ 1 more
- (no CPE)range: >= 12.0.0, < 12.4.37
- (no CPE)range: >= 11.0.0, < 12.4.37
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-j8vm-7q52-2m2mghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-59019ghsaADVISORY
- typo3.org/security/advisory/typo3-core-sa-2025-023nvdVendor AdvisoryWEB
- github.com/TYPO3-CMS/backend/commit/c983415f062c32f8edbb78544a0ff3219bc35d17ghsaWEB
News mentions
0No linked articles in our index yet.