TYPO3 FileManager Upload: Upload any file type, vulnerable before v13.4.12
CVE-2025-47939 Published on May 20, 2025
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer
TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be considered potentially harmful, such as executable binaries (e.g., `.exe` files), or files with inconsistent file extensions and MIME types (for example, a file incorrectly named with a `.png` extension but actually carrying the MIME type `application/zip`) starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS. Although such files are not directly executable through the web server, their presence can introduce indirect risks. For example, third-party services such as antivirus scanners or malware detection systems might flag or block access to the website for end users if suspicious files are found. This could negatively affect the availability or reputation of the site. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.
Vulnerability Analysis
CVE-2025-47939 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity and availability.
Weakness Types
Insufficient Type Distinction
The software does not properly distinguish between different types of elements in a way that leads to insecure behavior.
What is an Unrestricted File Upload Vulnerability?
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
CVE-2025-47939 has been classified to as an Unrestricted File Upload vulnerability or weakness.
Products Associated with CVE-2025-47939
Want to know whenever a new CVE is published for TYPO3? stack.watch will email you.
Affected Versions
typo3:- Version >= 9.0.0, < 9.5.51 is affected.
- Version >= 10.0.0, < 10.4.50 is affected.
- Version >= 11.0.0, < 11.5.44 is affected.
- Version >= 12.0.0, < 12.4.31 is affected.
- Version >= 13.0.0, < 13.4.12 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.