TYPO3 CMS EUVD-2026-35394

Exploitation requires three concurrent conditions: (1) the TYPO3 application has an endpoint that accepts a URL value from attacker-influenced input (e.g., a query parameter, form field, or HTTP header); (2) that URL is passed through GeneralUtility::sanitizeLocalUrl as a locality validation gate; and (3) the sanitized return value is subsequently used directly in an HTTP redirect or equivalent navigation operation without additional validation. The CVSS vector (PR:N) confirms no authentication is required, but UI:P confirms a victim must take a passive action - typically clicking a crafted link. Exploitation is not possible against TYPO3 installations where no code path passes attacker-supplied URL data through sanitizeLocalUrl into a redirect. TYPO3's own backend and frontend authentication flows are the most likely built-in redirect surfaces, but custom extensions using this utility function are equally in scope.

CVSS 4.0 rates this 5.3 (Medium) with vector AV:N/AC:L/AT:N/PR:N/UI:P, indicating network-reachable exploitation requiring no authentication and no special attack preconditions, but gated on passive user interaction (a victim must follow or be redirected via the crafted URL). Subsequent-system integrity impact is Low (SI:L), consistent with the phishing/redirect nature of open redirect vulnerabilities rather than direct code execution or data exfiltration. No EPSS score was supplied in the input data; risk cannot be quantified against that signal. The vulnerability is not listed in CISA KEV and no public exploit code was identified, so exploitation status is unconfirmed in the wild. Real-world priority is moderate: the technical barrier is low and no authentication is required, but exploitability is conditional on the application having a redirect flow that accepts attacker-supplied input and routes it through sanitizeLocalUrl. Installations without such a user-facing redirect endpoint are not directly exposed. The broad version range across all maintained branches and the zero-authentication requirement justify timely patching.

An attacker identifies a TYPO3 login page or similar feature that accepts a redirect_url parameter, crafts a URL such as \\//attacker.example.com/phishing-page or //\\attacker.example.com, and distributes it via email or a compromised link. When a victim follows the URL, TYPO3's unpatched sanitizeLocalUrl passes the value as a valid local URL, and the application issues an HTTP redirect that the victim's browser resolves to the attacker-controlled external site. No public exploit code was identified at time of analysis, but the specific bypass strings are enumerated verbatim in the upstream fix's unit test additions, making reproduction straightforward.