CVE-2025-30083: 
PHP vulnerability analysis and mitigation

CVE-2025-30083 is a Cross-Site Scripting (XSS) vulnerability discovered in the Additional TCA extension (additional_tca) for TYPO3 CMS. The vulnerability was disclosed on March 18, 2025, affecting versions 1.7.0 through 1.15.16 and 1.16.0 through 1.16.8 of the extension (TYPO3 Advisory).

The vulnerability stems from improper encoding of user input for output in the HTML context within the TYPO3 backend user interface. It has been assigned a moderate severity rating with a CVSS v3.1 base score of 5.1, and the vector string AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C. The vulnerability is classified as CWE-79 (Cross-Site Scripting) (GitHub Advisory).

The vulnerability allows logged-in backend users to create malicious output in the HTML context by exploiting improperly encoded user input. This could potentially lead to the execution of arbitrary JavaScript code in the context of other users' browser sessions, affecting the confidentiality, integrity, and availability of the system with low impact (TYPO3 Advisory).

Updated versions 1.15.17 and 1.16.9 have been released to address this vulnerability. Users are advised to update the extension as soon as possible. Additionally, the TYPO3 Security Team recommends enabling the Content Security Policy (CSP) for the TYPO3 backend user interface in TYPO3 12.4. In TYPO3 13.4, this security feature is enabled by default (TYPO3 Advisory).