EUVD-2026-35394
GHSA-3p42-w5ch-gg42
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (f4fb688c-4412-4426-b4b8-421ecf27b14a) · only source for this CVE.
CVSS VectorVendor: f4fb688c-4412-4426-b4b8-421ecf27b14a
Lifecycle Timeline
3DescriptionCVE.org
Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
AnalysisAI
Open redirect exploitation in TYPO3 CMS allows unauthenticated remote attackers to bypass the GeneralUtility::sanitizeLocalUrl locality check by crafting URLs containing backslash sequences, control characters, or slash-pattern variations that the prior implementation failed to reject, redirecting victims to arbitrary external sites for phishing. All major active TYPO3 branches are affected: versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the bypass patterns are explicitly documented in the upstream fix's own test suite, substantially lowering the bar to reproduction.
Technical ContextAI
TYPO3 CMS's GeneralUtility::sanitizeLocalUrl method (in typo3/sysext/core/Classes/Utility/GeneralUtility.php) is intended to validate that a URL resolves locally before applications use it in redirect operations. The root cause (CWE-601: URL Redirection to Untrusted Site) is an incomplete validation strategy: the prior implementation only rejected URLs containing literal newline (\n), carriage return (\r), and null byte (\x00) characters, leaving a wide range of bypass vectors unaddressed. As documented in the commit's added test cases, these include backslash-prefix sequences (\\//www.example.com, /\\/www.example.com, //\\www.example.com), protocol-relative quad-slash patterns (////www.example.com), and control characters such as EOT (\x04), BEL (\x07), backspace (\x08), and form feed (\x0c). Browsers and HTTP clients commonly interpret backslash characters as path separators equivalent to forward slashes, meaning a URL the PHP validator classifies as a relative local path is treated as an absolute external host reference by the browser. The fix replaced the narrow exclusion-list approach with a strict RFC 3986-compliant character allowlist covering only percent-encoding, reserved characters, unreserved characters, and alphanumerics - rejecting everything else by default.
RemediationAI
Upgrade TYPO3 CMS to a patched release per the vendor advisory at https://typo3.org/security/advisory/typo3-core-sa-2026-009. For the 10.x branch, version 10.4.57 is confirmed as the fixed release. Fixed versions for the 11.x, 12.x, 13.x, and 14.x branches are not explicitly stated in the available data and must be verified from that advisory. Source-level fixes are available in two upstream commits: https://github.com/TYPO3/typo3/commit/22c2dd5398ebc4cb7aa4aa37e02cb39181dee0cd and https://github.com/TYPO3/typo3/commit/3ffc0835012c6199db0e1dc4b56a77147d8600e0. For installations that cannot be patched immediately, audit all application code calling GeneralUtility::sanitizeLocalUrl and add a secondary post-sanitization check - for example, verifying that parse_url($sanitizedUrl, PHP_URL_HOST) returns null or matches the application's own hostname before issuing a redirect. Note that this secondary check must itself account for backslash-based bypass patterns, as PHP's parse_url behavior with malformed URLs varies across versions; test against the bypass patterns documented in the upstream commit's test suite before relying on this workaround.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today