CVE-2025-59016

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
TYPO3CNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 10%
VendorProductVersion
typo3typo3
9.0.0 ≤
𝑥
< 9.5.55
typo3typo3
10.0.0 ≤
𝑥
≤ 10.4.54
typo3typo3
11.0.0 ≤
𝑥
≤ 11.5.48
typo3typo3
12.0.0 ≤
𝑥
≤ 12.4.37
typo3typo3
13.0.0 ≤
𝑥
≤ 13.4.18
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://typo3.org/security/advisory/typo3-core-sa-2025-020