# CVE-2025-59021: cms-redirects — Fixed in 14.0.2 🐘 Packagist Not in CISA KEV # CVE-2025-59021 — cms-redirects [Fix: TYPO3/typo3@8a46abd](https://github.com/TYPO3/typo3/commit/8a46abd8993e3a5a31a834dcd6c8f91adef57ce4) CVE-2025-59021 is a CWE-862 vulnerability in typo3/cms-redirects. A fix is available for typo3/cms-redirects — see the affected versions and patch details below. TYPO3 CMS Allows Broken Access Control in Redirects Module Also known as[GHSA-6c46-p6j5-3f49](/vulnerability/GHSA-6c46-p6j5-3f49) Published Jan 13, 2026 Updated Oct 28, 2026 Affected 5 pkgs Patched 5 / 5 Exploits None indexed Exploitation data as of Nov 6, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2025-59021. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.3%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs19th percentile — riskier than 19% of all scored CVEsHighest risk 0.00%0.26%0.51%0.77%0.0%0.3%May 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## Real-World Exposure 5 pkgs affected 🐘`typo3/cms-redirects`🐘`typo3/cms-redirects`🐘`typo3/cms-redirects`🐘`typo3/cms-redirects`🐘`typo3/cms-redirects` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems. ## Description #### Problem Backend users with access to the redirects module and write permission on the `sys_redirect` table were able to read, create, and modify any redirect record - without restriction to the user’s own file‑mounts or web‑mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs - facilitating phishing or other malicious redirect attacks. #### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. #### Credits Thanks to Georg Dümmler for reporting this issue, and to TYPO3 security team member Elias Häußler for fixing it. #### References - [TYPO3-CORE-SA-2026-002](https://typo3.org/security/advisory/typo3-core-sa-2026-002) ## Affected Packages 5 total 5 fixed Ecosystem Package Vulnerable range Fix 🐘Packagist `typo3/cms-redirects` ≥ 14.0.0&&< 14.0.2 14.0.2`composer require typo3/cms-redirects:^14.0.2` 🐘Packagist `typo3/cms-redirects` ≥ 13.0.0&&< 13.4.23 13.4.23`composer require typo3/cms-redirects:^13.4.23` 🐘Packagist `typo3/cms-redirects` ≥ 12.0.0&&< 12.4.41 12.4.41`composer require typo3/cms-redirects:^12.4.41` 🐘Packagist `typo3/cms-redirects` ≥ 11.0.0&&< 11.5.49 11.5.49`composer require typo3/cms-redirects:^11.5.49` 🐘Packagist `typo3/cms-redirects` ≥ 10.0.0&&< 10.4.55 10.4.55`composer require typo3/cms-redirects:^10.4.55` ## Affected Products 1 product · 5 configurations Application `typo3`typo3 ≥ 14.0.0 && < 14.0.2 range ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for typo3/cms-redirects, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update typo3/cms-redirects to 14.0.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2025-59021 is resolved across your whole dependency graph. 3. ### Workarounds Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used. ## Frequently Asked Questions \### Problem Backend users with access to the redirects module and write permission on the \`sys\_redirect\` table were able to read, create, and modify any redirect record - without restriction to the user’s own file‑mounts or web‑mounts. This allowed attackers to insert or alter redirects pointing to arbitrary URLs - facilitating phishing or other malicious redirect attacks. ### Solution Update to TYPO3 versions 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, 14.0.2 that fix the problem described. ### Credits Thanks to Georg Dümmler for reporting this issue, and to TYPO3 security team m O3 Security · Impact-Aware SCA ### Is CVE-2025-59021 in your dependencies? Find it across Packagist, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)