Vulnerability advisory

CVE-2025-47940

TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer

Published May 20, 2025Updated Oct 28, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
36096733dea4bd6f6168209609fa879dc25c0138 to before 1f80000d7c594d2333efd2bef2f842338a0115a6	`1f80000d7c594d2333efd2bef2f842338a0115a6`
fd8745e46bb11773e85524b8ee9650dabe340713 to before 812e327a74813bdb07d19cde3076d3d41b8ca4cf	`812e327a74813bdb07d19cde3076d3d41b8ca4cf`
Also listed as affected (52) `v13.4.11` `v12.4.30` `v13.4.10` `v12.4.29` `v13.4.9` `v13.4.8` `v12.4.28` `v13.4.7` `v13.4.6` `v13.4.5` `v12.4.27` `v13.4.4` `v12.4.26` `v13.4.3` `v12.4.25` `v13.4.2` `v12.4.24` `v13.4.1` `v12.4.23` `v12.4.22` `v13.4.0` `v12.4.21` `v13.3.0` `v12.4.20` `v12.4.19` `v12.4.18` `v12.4.17` `v13.2.1` `v13.2.0` `v12.4.16` `v12.4.15` `v13.1.0` `v12.4.14` `v12.4.13` `v12.4.12` `v12.4.11` `v13.0.0` `v12.4.10` `v12.4.9` `v12.4.8` `v12.4.7` `v12.4.6` `v12.4.5` `v12.4.4` `v12.4.3` `v12.4.2` `v12.4.1` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0`

Description

TYPO3 is an open source, PHP based web content management system. Starting in version 10.0.0 and prior to versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, administrator-level backend users without system maintainer privileges can escalate their privileges and gain system maintainer access. Exploiting this vulnerability requires a valid administrator account. Users should update to TYPO3 version 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

CVE-2025-47940

Affected versions

Repository

Description

References