QwikSec

Security Database

CVE

CWE

Training

CVE-2025-59019

Published: Sep 9, 2025

Modified: Sep 11, 2025

PUBLISHED

Description

Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.

Vendor	Product	Versions
TYPO3	TYPO3 CMS	affected `12.0.0 - < 12.4.37` affected `13.0.0 - < 13.4.18`
TYPO3	TYPO3 CMS	affected `11.0.0 - < 11.5.48`

Weaknesses (CWE)

References

https://typo3.org/security/advisory/typo3-core-sa-2025-023

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.