CVE-2025-47939
CVE-2025-47939 is a medium-severity vulnerability in Typo3 with a CVSS 3.x base score of 5.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-351.
Key facts
- Severity: Medium (CVSS 3.x base score 5.4)
- EPSS exploit prediction: 0% (5th percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2025-15955
- Weakness: CWE-351
- Affected product: Typo3
- Published:
- Last modified:
Description
TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be considered potentially harmful, such as executable binaries (e.g., `.exe` files), or files with inconsistent file extensions and MIME types (for example, a file incorrectly named with a `.png` extension but actually carrying the MIME type `application/zip`) starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS. Although such files are not directly executable through the web server, their presence can introduce indirect risks. For example, third-party services such as antivirus scanners or malware detection systems might flag or block access to the website for end users if suspicious files are found. This could negatively affect the availability or reputation of the site. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.
Frequently asked questions
- What is CVE-2025-47939?
- TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be considered potentially harmful, such as executable binaries (e.g., `.exe` files), or files with inconsistent file extensions and MIME types (for example, a file incorrectly named with a `.png` extension but actually carrying the MIME type `application/zip`) starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS. Although such files are not directly executable through the web server, their presence can introduce indirect risks. For example, third-party services such as antivirus scanners or malware detection systems might flag or block access to the website for end users if suspicious files are found. This could negatively affect the availability or reputation of the site. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.
- How severe is CVE-2025-47939?
- CVE-2025-47939 has a CVSS 3.x base score of 5.4, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.
- Is CVE-2025-47939 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (5th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2025-47939?
- CVE-2025-47939 affects Typo3. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2025-47939?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2025-47939 have an EU (EUVD) identifier?
- Yes. CVE-2025-47939 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-15955.
- When was CVE-2025-47939 published?
- CVE-2025-47939 was published on 2025-05-20 and last updated on 2026-06-17.
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-9hq9-cr36-4wpj
- https://typo3.org/security/advisory/typo3-core-sa-2025-014
Affected products (1)
- cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
More vulnerabilities in Typo3
- CVE-2009-0258 — Critical (CVSS 10.0): The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and…
- CVE-2011-3583 — Critical (CVSS 9.8): It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not…
- CVE-2011-4628 — Critical (CVSS 9.8): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication…
- CVE-2025-59017 — High (CVSS 8.8): Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53,…
- CVE-2023-24814 — High (CVSS 8.8): TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected…
- CVE-2021-41113 — High (CVSS 8.8): TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that…
Other CWE-351 vulnerabilities
- CVE-2025-30510 — Critical (CVSS 9.8): An attacker can upload an arbitrary file instead of a plant image.
- CVE-2025-54413 — High (CVSS 8.7): skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below…
- CVE-2025-54412 — High (CVSS 8.7): skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below…
- CVE-2025-65960 — Medium (CVSS 6.6): Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users…
- CVE-2024-4769 — Medium (CVSS 5.9): When importing resources using Web Workers, error messages would distinguish the difference between…
- CVE-2026-41341 — Medium (CVSS 5.4): OpenClaw before 2026.3.31 contains a logic error in Discord component interaction routing that misclassifies group…