CVE-2025-59021: 
PHP vulnerability analysis and mitigation

CVE-2025-59021 is a broken access control (missing authorization) vulnerability in the TYPO3 CMS redirects module. Backend users with access to the redirects module and write permission on the sys_redirect table could read, create, and modify any redirect record without restriction to their own file-mounts or web-mounts, enabling insertion or alteration of redirects pointing to arbitrary URLs to facilitate phishing or other malicious redirect attacks. It affects TYPO3 CMS versions 10.0.0–10.4.54, 11.0.0–11.5.48, 12.0.0–12.4.40, 13.0.0–13.4.22, and 14.0.0–14.0.1. The vulnerability was disclosed on January 13, 2026, with a CVSS v3.1 base score of 6.4 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, TYPO3 Advisory).

The root cause is CWE-862 (Missing Authorization): the redirects module's ManagementController and associated data handlers did not verify whether the authenticated backend user had permission to access or modify redirect records outside their assigned web-mounts or file-mounts. Specifically, the sys_redirect table write operations lacked checks against the user's permitted source hosts and redirect targets, and no canListRedirects() or canEditRedirects() gate existed before processing requests. The fix introduced RedirectPermissionGuard, DataHandlerPermissionGuardHook, and a new SourceHostProvider class that filters allowed source hosts based on the user's web-mounts, and added explicit tables_select/tables_modify permission checks in the controller (GitHub Commit, GitHub Advisory). Exploitation requires an authenticated backend account with redirects module access and sys_redirect write permission — no unauthenticated access path exists.

A malicious or compromised backend user can insert or alter redirect records to point site visitors to arbitrary external URLs, enabling phishing campaigns, credential harvesting via counterfeit sites, or distribution of malware. The vulnerability affects the integrity and confidentiality of the site's redirect functionality with a changed scope (impacting end users beyond the TYPO3 backend itself). Availability is not directly impacted, and the attacker cannot escalate to server-level code execution through this vulnerability alone (GitHub Advisory, TYPO3 Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.039%, reflecting a low probability of near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid backend user account with specific module access, limiting the attack surface to insider threats or compromised credentials.

1. Obtain backend access: Acquire credentials for a TYPO3 backend user account that has access to the redirects module and write permission on the sys_redirect table (e.g., through phishing, credential stuffing, or insider access).
2. Log in to the TYPO3 backend: Authenticate to the TYPO3 backend interface (typically at /typo3/ on the target host).
3. Navigate to the Redirects module: Access the Redirects module from the backend navigation menu.
4. Create or modify a redirect record: Use the "Add redirect" button or edit an existing redirect record. Without the patch, the module does not restrict which source hosts or target URLs can be used based on the user's web-mounts.
5. Insert a malicious redirect: Set the source path to a legitimate-looking URL path on the target site (e.g., /login or /account) and the redirect target to an attacker-controlled phishing URL (e.g., https://attacker.example.com/fake-login).
6. Activate the redirect: Save the record. Site visitors accessing the source path will now be silently redirected to the attacker's URL, enabling credential harvesting or malware delivery (GitHub Advisory, TYPO3 Advisory).

• Logs: TYPO3 backend access logs showing sys_redirect record creation or modification by non-administrator backend users, particularly for source hosts outside their assigned web-mounts; DataHandler log entries with messages such as Attempt to modify sys_redirect record (present only after patching).
• Database: Unexpected or unauthorized entries in the sys_redirect table pointing to external or unfamiliar URLs, especially those added by low-privilege backend users; redirect targets containing external domains not associated with the site.
• Network: Unusual outbound redirects from the web server to external domains observed in web server access logs (HTTP 301/302 responses to unexpected destinations for common paths like /login, /account, etc.).
• Application: Redirect records with source hosts outside the expected site domains, or redirect targets pointing to IP addresses or newly registered domains.

Update TYPO3 CMS to the patched versions: 10.4.55 ELTS, 11.5.49 ELTS, 12.4.41 LTS, 13.4.23 LTS, or 14.0.2 (GitHub Advisory, TYPO3 Advisory). As an interim workaround, restrict backend user permissions by removing redirects module access and sys_redirect table write permissions from all non-administrator users who do not require them. Additionally, audit existing sys_redirect records for unauthorized or suspicious entries pointing to external URLs, and consider implementing database-level access controls on the sys_redirect table where feasible.

The vulnerability was reported by Georg Dümmler and fixed by TYPO3 security team member Elias Häußler, with the advisory published under TYPO3-CORE-SA-2026-002 on January 13, 2026 (GitHub Advisory). The issue received standard coverage from vulnerability tracking services including Vulners, CVEFeed, and VulDB shortly after disclosure, with no notable controversy or significant social media discussion identified.