CVE-2026-47347: 
PHP vulnerability analysis and mitigation

CVE-2026-47347 is an open redirect vulnerability in TYPO3 CMS affecting the GeneralUtility::sanitizeLocalUrl core utility function. Applications using this function to restrict redirects to local URLs are vulnerable to bypass attacks, enabling attackers to redirect users to arbitrary external sites for phishing purposes. The vulnerability affects TYPO3 CMS versions before 10.4.57, 11.0.0–11.5.50, 12.0.0–12.4.45, 13.0.0–13.4.30, and 14.0.0–14.3.2. It was published on June 9, 2026, and carries a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, RedHat CVE).

The root cause is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect). The vulnerable GeneralUtility::sanitizeLocalUrl function in typo3/sysext/core/Classes/Utility/GeneralUtility.php previously only checked for a narrow set of disallowed characters (\n, \r, \x00), allowing crafted URLs containing backslashes, special control characters, or other bypass sequences (e.g., \\//evil.site, /\\www.google.de, or URLs with unencoded spaces) to pass validation and subsequently be used as redirect targets. The fix replaces this blocklist approach with a strict allowlist of valid RFC 3986 URL characters, rejecting any URL containing characters outside that set (Github Commit 3ffc083, Github Commit 22c2dd5). Exploitation requires passive user interaction — a victim must follow a crafted link — and no authentication or special privileges are needed (Github Advisory).

Successful exploitation allows an unauthenticated attacker to redirect authenticated or unauthenticated TYPO3 users to arbitrary external websites, facilitating phishing attacks, credential harvesting, or malware distribution. There is no direct impact on the confidentiality, integrity, or availability of the TYPO3 server itself; the primary risk is to end users who trust the legitimacy of the originating TYPO3 domain. The subsequent system integrity impact is rated Low, reflecting the potential for user deception rather than server compromise (Github Advisory).

1. Identify target: Locate a TYPO3 CMS instance running a vulnerable version (before 10.4.57, 11.5.51, 12.4.46, 13.4.31, or 14.3.3) that uses GeneralUtility::sanitizeLocalUrl for redirect handling.
2. Craft bypass URL: Construct a URL that passes the old sanitization check but resolves to an external domain. Examples include URLs with backslash sequences (e.g., \\//evil.example.com, /\\/evil.example.com) or control characters that browsers interpret as redirects to external hosts.
3. Embed in redirect parameter: Inject the crafted URL into a TYPO3 redirect parameter (e.g., a login redirect, form submission redirect, or any application feature that calls sanitizeLocalUrl and then uses the returned value for redirection).
4. Deliver to victim: Send the crafted link to a target user via email, social media, or other channels, leveraging the trusted TYPO3 domain to increase credibility.
5. Phishing/credential harvest: When the victim clicks the link and interacts with the TYPO3 page, they are transparently redirected to the attacker-controlled external site, where credentials or sensitive information may be harvested (Github Advisory, Github Commit 3ffc083).

• Logs: TYPO3 application logs (typo3temp/var/log/) containing entries such as 'URL "{url}" contains unexpected whitespace and was denied as local url' (pre-patch) or 'The URL "{url}" contains unexpected characters and was denied as local url' (post-patch) may indicate attempted exploitation.
• Network: Web server access logs showing requests with redirect parameters containing backslash sequences (e.g., %5C%5C, \\, \/), control characters, or external domain names in fields expected to contain only local paths.
• Network: Outbound HTTP redirects (301/302 responses) from the TYPO3 server pointing to external or unexpected domains in response to requests targeting redirect-handling endpoints.

TYPO3 has released patched versions that resolve this vulnerability: 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, and 14.3.3 LTS. Upgrading to one of these versions is the recommended and only confirmed remediation; no configuration-based workaround is documented. Organizations should prioritize upgrading, particularly if their TYPO3 installations expose redirect functionality to unauthenticated users (Github Advisory, TYPO3 Advisory).

TYPO3 credited security researcher Alexandre Romao for reporting the issue and TYPO3 core & security team member Benjamin Franzke for developing the fix (Github Advisory). No significant broader media coverage or notable community commentary beyond the official advisory and standard vulnerability database entries has been identified.