Medium severity · published Sep 9, 2025
CVE-2025-59019
Information Disclosure via CSV Download
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within the users' web mounts without having access to them.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
TYPO3 CMS · TYPO3
12.0.0 before 12.4.37; 13.0.0 before 13.4.18; 11.0.0 before 11.5.48 · source: vendor
TY
Typo3 · Typo3
11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-59019
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-59019
Vendor Advisory
https://typo3.org/security/advisory/typo3-core-sa-2025-023
More from TYPO3 CMS
8.8
CVE-2025-59017
Broken Access Control in Backend AJAX Routes
8.7
CVE-2026-49741
TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
8.1
CVE-2025-59022
TYPO3 CMS Allows Broken Access Control in Recycler Module
7.8
CVE-2026-0859
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
7.6
CVE-2026-47346
TYPO3 CMS - Broken Access Control in Form Framework