Vulnerability advisory

CVE-2025-59019

Information Disclosure via CSV Download

Published Sep 9, 2025Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
36096733dea4bd6f6168209609fa879dc25c0138 to before fa6ceeff93eb36ad5e8b36abe4ca2b1644706304	`fa6ceeff93eb36ad5e8b36abe4ca2b1644706304`
fd8745e46bb11773e85524b8ee9650dabe340713 to before 34025c4b1658dffd995206bbf507124b6e357e89	`34025c4b1658dffd995206bbf507124b6e357e89`
Also listed as affected (64) `v12.4.36` `v13.4.17` `v13.4.16` `v12.4.35` `v13.4.15` `v12.4.34` `v13.4.14` `v12.4.33` `v13.4.13` `v12.4.32` `v13.4.12` `v12.4.31` `v13.4.11` `v12.4.30` `v13.4.10` `v12.4.29` `v13.4.9` `v13.4.8` `v12.4.28` `v13.4.7` `v13.4.6` `v13.4.5` `v12.4.27` `v13.4.4` `v12.4.26` `v13.4.3` `v12.4.25` `v13.4.2` `v12.4.24` `v13.4.1` `v12.4.23` `v12.4.22` `v13.4.0` `v12.4.21` `v13.3.0` `v12.4.20` `v12.4.19` `v12.4.18` `v12.4.17` `v13.2.1` `v13.2.0` `v12.4.16` `v12.4.15` `v13.1.0` `v12.4.14` `v12.4.13` `v12.4.12` `v12.4.11` `v13.0.0` `v12.4.10` `v12.4.9` `v12.4.8` `v12.4.7` `v12.4.6` `v12.4.5` `v12.4.4` `v12.4.3` `v12.4.2` `v12.4.1` `v12.4.0` `v12.3.0` `v12.2.0` `v12.1.0` `v12.0.0`

Description

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‐11.5.47, 12.0.0‐12.4.36, and 13.0.0‐13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

CVE-2025-59019

Affected versions

Repository

Description

References