Vulnerability advisory

CVE-2026-47347

TYPO3 CMS - Open Redirect in Core Utilities

Published Jun 9, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
fd8745e46bb11773e85524b8ee9650dabe340713 to before 59bfeaaf0136dfe17011786ce825884e48bedc8d	`59bfeaaf0136dfe17011786ce825884e48bedc8d`
6d6bd23afff6a48ee3efeaa68eb829820397d6a1 to before e16ec78165a7d60f09dcac04bfbb309409e174b3	`e16ec78165a7d60f09dcac04bfbb309409e174b3`
Not specified	`3ffc0835012c6199db0e1dc4b56a77147d8600e0`
Not specified	`22c2dd5398ebc4cb7aa4aa37e02cb39181dee0cd`
Also listed as affected (42) `v14.3.2` `v13.4.30` `v14.3.1` `v13.4.29` `v14.3.0` `v13.4.28` `v14.2.0` `v13.4.27` `v13.4.26` `v14.1.0` `v13.4.25` `v13.4.24` `v13.4.23` `v13.4.22` `v13.4.21` `v14.0.0` `v13.4.20` `v13.4.19` `v13.4.18` `v13.4.17` `v13.4.16` `v13.4.15` `v13.4.14` `v13.4.13` `v13.4.12` `v13.4.11` `v13.4.10` `v13.4.9` `v13.4.8` `v13.4.7` `v13.4.6` `v13.4.5` `v13.4.4` `v13.4.3` `v13.4.2` `v13.4.1` `v13.4.0` `v13.3.0` `v13.2.1` `v13.2.0` `v13.1.0` `v13.0.0`

Description

Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

CVE-2026-47347

Affected versions

Repository

Description

References