PT-2026-47740

CVE-2026-47347

Published

2026-06-09

Updated

2026-06-12

Description by

CVSS 4.0

5.3

Medium

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions prior to 10.4.57 TYPO3 CMS versions 11.0.0 through 11.5.50 TYPO3 CMS versions 12.0.0 through 12.4.45 TYPO3 CMS versions 13.0.0 through 13.4.30 TYPO3 CMS versions 14.0.0 through 14.3.2

Description Applications utilizing the sanitizeLocalUrl() function within the GeneralUtility class to restrict URLs to local addresses are susceptible to open redirect attacks. This occurs when a URL is used after passing the sanitization checks, allowing attackers to redirect users to external malicious content, which can be leveraged for phishing attacks.

Recommendations Update to version 10.4.57 or later. Update to version 11.5.51 or later. Update to version 12.4.46 or later. Update to version 13.4.31 or later. Update to version 14.3.3 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Alexandre Romao

Benjamin Franzke

Vendors

Affected products

Weakness enumeration

CWE-601: URL Redirection to Untrusted Site (\'Open Redirect\')

Related identifiers