CVE-2025-48204 The Backup Plus extension for TYPO3 (ns_backup) allows command injections
An attacker can execute arbitrary commands via the ns_backup extension for TYPO3, potentially compromising the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48204?
CVE-2025-48204 is a medium-severity command injection vulnerability in TYPO3 ns backup extension, published on 21 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The ns_backup extension through 13.0.0 for TYPO3 allows command injection.
Weakness: CWE-78
Which versions are affected by CVE-2025-48204?
2 open source packages ship an affected version, including nitsan/ns-backup.
| Package | Affected | Fixed in |
|---|---|---|
nitsan/ns-backup Packagist | All versions | 13.0.1 |
nitsan/ns-backup Packagist | All versions | 13.0.1 |
How do I fix CVE-2025-48204?
Upgrade nitsan/ns-backup to 13.0.1 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-48204 being exploited?
There is no known exploitation of CVE-2025-48204 in the wild and no public exploit code.
Sources
Also known as GHSA-463c-jhp2-4mm7.