ByteOS Network

NVD Vulnerability Details :

CVE-2025-59022

Analyzed

Source-f4fb688c-4412-4426-b4b8-421ecf27b14a

Published At-13 Jan, 2026 | 12:15

Updated At-14 Jan, 2026 | 19:07

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	4.0	7.1	HIGH	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary	3.1	8.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Type: Secondary

Version: 4.0

Base score: 7.1

Base severity: HIGH

Vector:

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Type: Primary

Version: 3.1

Base score: 8.1

Base severity: HIGH

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

CPE Matches

TYPO3 Association

>>typo3>>Versions from 10.0.0(inclusive) to 10.4.55(exclusive)

cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

TYPO3 Association

>>typo3>>Versions from 11.0.0(inclusive) to 11.5.49(exclusive)

cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

TYPO3 Association

>>typo3>>Versions from 12.0.0(inclusive) to 12.4.41(exclusive)

cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

TYPO3 Association

>>typo3>>Versions from 13.0.0(inclusive) to 13.4.23(exclusive)

cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*

TYPO3 Association

>>typo3>>Versions from 14.0.0(inclusive) to 14.0.2(exclusive)

cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*