Executive brief
TYPO3 CMS, a popular content management system, contains a security flaw in how it validates web addresses. An attacker can trick users into clicking a link that appears to stay within the trusted website but instead redirects them to a malicious external site. This is commonly used in phishing campaigns to steal user credentials or distribute malware.
Technical details
An open redirect vulnerability exists in TYPO3 CMS within the `GeneralUtility::sanitizeLocalUrl` function. The root cause is a failure in the sanitization logic intended to restrict URLs to local paths, which can be bypassed to point to external domains. An attacker can exploit this by crafting a URL that, when processed by an application using this utility, redirects a victim to an arbitrary external site. This requires minimal user interaction (clicking a link) and no prior authentication. Patches have been released for all supported branches including ELTS and LTS versions.
Affected products
- TYPO3 TYPO3 CMS < 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, 14.0.0-14.3.2
Timeline
- 2026-06-09: disclosed
- 2026-06-09: patched
- 2026-06-12: advisory
References
- https://github.com/TYPO3/typo3/security/advisories/GHSA-3p42-w5ch-gg42
- https://github.com/TYPO3/typo3/commit/22c2dd5398ebc4cb7aa4aa37e02cb39181dee0cd
- https://github.com/TYPO3/typo3/commit/3ffc0835012c6199db0e1dc4b56a77147d8600e0
- https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47347.yaml
- https://typo3.org/security/advisory/typo3-core-sa-2026-009