# CVE-2026-47347: TYPO3 CMS open redirect in GeneralUtility::sanitizeLocalUrl

Source: https://junglewise.ai/threats/cve-2026-47347-typo3-cms-open-redirect-in-generalutility-sanitizelocalurl  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-06-12  
License: CC BY 4.0 with a link back

CVE-2026-47347 · Severity: medium · CVSS 4 · Published 2026-06-09

TYPO3 CMS, a popular content management system, contains a security flaw in how it validates web addresses. An attacker can trick users into clicking a link that appears to stay within the trusted website but instead redirects them to a malicious external site. This is commonly used in phishing campaigns to steal user credentials or distribute malware.

Technologies: [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-47347 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47347 being exploited in the wild.

**How severe is CVE-2026-47347?** Medium severity, with a CVSS score of 4, published 9 June 2026.

**Which products and versions are affected?** typo3/cms-core (Packagist) ECOSYSTEM:introduced=0,fixed=10.4.57.

**Is there a fix for CVE-2026-47347?** Yes. typo3/cms-core (Packagist): upgrade to 10.4.57 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47347 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-47347?** Check whether you run typo3/cms-core (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- typo3/cms-core (Packagist): upgrade to 10.4.57 or later

  ```sh
  composer require typo3/cms-core:^10.4.57
  ```


## Technical details

An open redirect vulnerability exists in TYPO3 CMS within the `GeneralUtility::sanitizeLocalUrl` function. The root cause is a failure in the sanitization logic intended to restrict URLs to local paths, which can be bypassed to point to external domains. An attacker can exploit this by crafting a URL that, when processed by an application using this utility, redirects a victim to an arbitrary external site. This requires minimal user interaction (clicking a link) and no prior authentication. Patches have been released for all supported branches including ELTS and LTS versions.

## Affected products

- TYPO3 TYPO3 CMS < 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, 14.0.0-14.3.2

## Identifiers

- CVE-2026-47347
- GHSA-3p42-w5ch-gg42

## Timeline

- 2026-06-09: disclosed
- 2026-06-09: patched
- 2026-06-12: advisory

## References

- [https://github.com/TYPO3/typo3/security/advisories/GHSA-3p42-w5ch-gg42](https://github.com/TYPO3/typo3/security/advisories/GHSA-3p42-w5ch-gg42)
- [https://github.com/TYPO3/typo3/commit/22c2dd5398ebc4cb7aa4aa37e02cb39181dee0cd](https://github.com/TYPO3/typo3/commit/22c2dd5398ebc4cb7aa4aa37e02cb39181dee0cd)
- [https://github.com/TYPO3/typo3/commit/3ffc0835012c6199db0e1dc4b56a77147d8600e0](https://github.com/TYPO3/typo3/commit/3ffc0835012c6199db0e1dc4b56a77147d8600e0)
- [https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47347.yaml](https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47347.yaml)
- [https://typo3.org/security/advisory/typo3-core-sa-2026-009](https://typo3.org/security/advisory/typo3-core-sa-2026-009)

## Related threats

- [The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 became ineffective in TYPO3 v13.0, where TYPO3 CMS started](https://junglewise.ai/threats/cve-2026-19418-typo3-cms-broken-access-control-in-backend-and-install-tool)
- [TYPO3 CMS broken access control in Media Module](https://junglewise.ai/threats/cve-2026-49742-typo3-cms-broken-access-control-in-media-module)
- [TYPO3 CMS broken access control in Form Framework form_definition table](https://junglewise.ai/threats/cve-2026-49741-typo3-cms-broken-access-control-in-form-framework-form-definition)
- [TYPO3 CMS insecure deserialization in VariableFrontend and Registry](https://junglewise.ai/threats/cve-2026-49740-typo3-cms-insecure-deserialization-in-variablefrontend-and)
- [TYPO3 CMS path traversal in GeneralUtility::isAllowedAbsPath](https://junglewise.ai/threats/cve-2026-49738-typo3-cms-path-traversal-in-generalutility-isallowedabspath)