CVE-2025-47936 TYPO3 Vulnerable to Server Side Request Forgery via Webhooks
Administrators can exploit TYPO3 webhooks to perform Server-Side Request Forgery, allowing access to internal network resources.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-47936?
CVE-2025-47936 is a low-severity server-side request forgery vulnerability in Typo3 Typo3, published on 20 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, Webhooks are inherently vulnerable to Cross-Site Request Forgery (CSRF), which can be exploited by adversaries to target internal resources (e.g., localhost or other services on the local network). While this is not a vulnerability in TYPO3 itself, it may enable attackers to blindly access systems that would otherwise be inaccessible. An administrator-level backend user account is required to exploit this vulnerability. Users should update to TYPO3 version 12.4.31 LTS or 13.4.12 LTS to fix the problem.
Weakness: CWE-918
Which versions are affected by CVE-2025-47936?
4 open source packages ship an affected version, including typo3/cms-webhooks. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms-webhooks Packagist | From 12.0.0 | 12.4.31 |
typo3/cms-webhooks Packagist | From 12.0.0 | 12.4.31 |
typo3/cms-webhooks Packagist | From 13.0.0 | 13.4.12 |
typo3/cms-webhooks Packagist | From 13.0.0 | 13.4.12 |
Products include Typo3 Typo3.
How do I fix CVE-2025-47936?
Upgrade typo3/cms-webhooks to a fixed version for your release line: 12.4.31 or 13.4.12.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-47936 being exploited?
There is no known exploitation of CVE-2025-47936 in the wild and no public exploit code.
Other vulnerabilities in Typo3 Typo3
- CVE-2009-0258 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
- CVE-2011-3583 Typo3 SQL injection due to faulty prepared statements
- CVE-2011-4628 Typo3 Authentication Bypass
- CVE-2023-24814 Persisted Cross-Site Scripting in Frontend Rendering in typo3
- CVE-2021-41113 Cross-Site-Request-Forgery in Backend URI Handling in Typo3
Sources
Also known as GHSA-p4xx-m758-3hpx.