CVE-2026-47347 json
TYPO3 CMS - Open Redirect in Core Utilities
published 2026-06-09 5 mo ago modified 2026-09-10 1 mo ago also GHSA-3p42-w5ch-gg42 , EUVD-2026-35394
- cvss
- 5.3
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 22%
- public exploits
- 0
- none known
Summary
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
Patch / fix
- packagist typo3/cms-core 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
- TYPO3 TYPO3 CMS 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
- github.com/TYPO3/typo3@3ffc083 commit
- github.com/TYPO3/typo3@22c2dd5 commit
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 22% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N |
| CNA | 4.0 | 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | <10.4.57 >=11.0.0, <11.5.51 >=12.0.0, <12.4.46 >=13.0.0, <13.4.31 >=14.0.0, <14.3.3 |
10.4.57 11.5.51 12.4.46 13.4.31 14.3.3 |
Affected products
- TYPO3 TYPO3 CMS
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/TYPO3/typo3/commit/3ffc0835012c6199db0e1dc4b56a77147d8600e0
patch, web
-
github.com
/TYPO3/typo3/commit/22c2dd5398ebc4cb7aa4aa37e02cb39181dee0cd
patch, web
-
typo3.org
/security/advisory/typo3-core-sa-2026-009
vendor-advisory, web
-
github.com
/TYPO3/typo3/security/advisories/GHSA-3p42-w5ch-gg42
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-47347
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47347.yaml
web
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2026-47347
- GitHub Advisory GHSA-3p42-w5ch-gg42
- NVD CVE-2026-47347
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.