CVE-2025-47936
Last modified
CVE-2025-47936 is a medium-severity vulnerability rated 4.4/10 on the CVSS scale. TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, Webhooks are inherently vulnerable to Cross-Site Request Forgery (CSRF), which can be exploited by adversaries to target internal resources (e.g., localhost or other services on the local network). EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, Webhooks are inherently vulnerable to Cross-Site Request Forgery (CSRF), which can be exploited by adversaries to target internal resources (e.g., localhost or other services on the local network). While this is not a vulnerability in TYPO3 itself, it may enable attackers to blindly access systems that would otherwise be inaccessible. An administrator-level backend user account is required to exploit this vulnerability. Users should update to TYPO3 version 12.4.31 LTS or 13.4.12 LTS to fix the problem.
Metrics
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Typo3 | Typo3 | >= 12.0.0, < 12.4.31 |
| Typo3 | Typo3 | >= 13.0.0, < 13.4.12 |
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-p4xx-m758-3hpxMitigation, Vendor Advisory
- https://typo3.org/security/advisory/typo3-core-sa-2025-012Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-47936?
How severe is CVE-2025-47936?
How do I fix CVE-2025-47936?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-47930Zulip is an open-source team chat application. Starting in v…5.3
- CVE-2025-47931LibreNMS is PHP/MySQL/SNMP based network monitoring software…6.1
- CVE-2025-47932Combodo iTop is a web based IT service management tool. Vers…6.1
- CVE-2025-47933Argo CD is a declarative, GitOps continuous delivery tool fo…5.4
- CVE-2025-47934OpenPGP.js is a JavaScript implementation of the OpenPGP pro…8.7
- CVE-2025-47935Multer is a node.js middleware for handling `multipart/form-…7.5
- CVE-2025-47937TYPO3 is an open source, PHP based web content management sy…5.3
- CVE-2025-47938TYPO3 is an open source, PHP based web content management sy…3.8
- CVE-2025-47939TYPO3 is an open source, PHP based web content management sy…5.4
- CVE-2025-4794A vulnerability was found in PHPGurukul Online Course Regist…9.8
- CVE-2025-47940TYPO3 is an open source, PHP based web content management sy…7.2
- CVE-2025-47941TYPO3 is an open source, PHP based web content management sy…7.2
Are you affected by CVE-2025-47936?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST