TYPO3 is an open source, PHP based web content management system. By design, the file management module in TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of those that are directly executable in a web server context. This lack of restriction means it is possible to upload files that may be considered potentially harmful, such as executable binaries (e.g., `.exe` files), or files with inconsistent file extensions and MIME types (for example, a file incorrectly named with a `.png` extension but actually carrying the MIME type `application/zip`) starting in version 9.0.0 and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS. Although such files are not directly executable through the web server, their presence can introduce indirect risks. For example, third-party services such as antivirus scanners or malware detection systems might flag or block access to the website for end users if suspicious files are found. This could negatively affect the availability or reputation of the site. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - TYPO3 is an open source, PHP based web content management system. By design, the file management module in
    TYPO3’s backend user interface has historically allowed the upload of any file type, with the exception of
    those that are directly executable in a web server context. This lack of restriction means it is possible
    to upload files that may be considered potentially harmful, such as executable binaries (e.g., `.exe`
    files), or files with inconsistent file extensions and MIME types (for example, a file incorrectly named
    with a `.png` extension but actually carrying the MIME type `application/zip`) starting in version 9.0.0
    and prior to versions 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS. Although such
    files are not directly executable through the web server, their presence can introduce indirect risks. For
    example, third-party services such as antivirus scanners or malware detection systems might flag or block
    access to the website for end users if suspicious files are found. This could negatively affect the
    availability or reputation of the site. Users should update to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS,
    11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem. (CVE-2025-47939)

The version of TYPO3 installed on the remote host is 9.0.0 prior to 9.5.51 ELTS / 10.0.0 prior to 10.4.50 ELTS / 11.0.0 prior to 11.5.44 ELTS / 12.0.0 prior to 12.4.31 / 13.0.0 prior to 13.4.12. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2025-014 advisory.

  - By design, the file management module in TYPO3's backend user interface has historically allowed the     upload of any file type, with the exception of those that are directly executable in a web server context.
    This lack of restriction means it is possible to upload files that may be considered potentially harmful,     such as executable binaries (e.g., .exe files), or files with inconsistent file extensions and MIME types     (for example, a file incorrectly named with a .png extension but actually carrying the MIME type     application/zip). Although such files are not directly executable through the web server, their presence     can introduce indirect risks. For example, third-party services such as antivirus scanners or malware     detection systems might flag or block access to the website for end users if suspicious files are found.
    This could negatively affect the availability or reputation of the site. (CVE-2025-47939)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
434780	SCA: security update for typo3/cms-core (GHSA-9hq9-cr36-4wpj)	Tenable Cloud Security	SCA Checks	medium
434780	SCA: security update for typo3/cms-core (GHSA-9hq9-cr36-4wpj)	Tenable Self-Hosted Container Security	SCA Checks	medium
236973	TYPO3 9.0.0 < 9.5.51 ELTS / 10.0.0 < 10.4.50 ELTS / 11.0.0 < 11.5.44 ELTS / 12.0.0 < 12.4.31 / 13.0.0 < 13.4.12 (TYPO3-CORE-SA-2025-014)	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2025-47939

medium

Tenable Plugins

medium

medium

medium