N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48206

CVE-2025-48206: The Backup Plus extension for TYPO3 (ns_backup) allows XSS

The ns_backup extension through 13.0.0 for TYPO3 allows XSS.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48206

CVE-2025-48206:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nitsan/ns-backup	composer	< 13.0.1	13.0.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis focused on changes in the provided patch (commit 67b8102a19e8e516dc4228f5c42f9e4fba5046cb) that indicated XSS vulnerabilities. Key indicators were:

Changes from TYPO3 Fluid's <f:format.raw> to <f:sanitize.html> in templates, showing that variables were previously rendered unsanitized. The controller actions supplying these variables are thus implicated.
Addition of input sanitization/validation for user-supplied data, particularly backupName, in controller actions (e.g., using htmlspecialchars, preg_replace). This suggests these inputs were vectors.
Changes in JavaScript from using jQuery's .html() method to .text() when inserting data (like backup titles) into the DOM. This points to client-side XSS where the data originated from server-side variables that were not properly sanitized before being embedded in HTML attributes or content.

The identified functions are those that either directly passed unsanitized data to views for rendering, or processed user input that was later used in a way that caused XSS. BackupsController::backuprestoreAction is highlighted due to multiple fixes: input validation for backupName, sanitizing {log} output, and providing data (backup.title) that was involved in client-side XSS. BackupglobalController::globalsettingAction is implicated due to its view rendering {errorValidation} raw. BackupBaseController::generateBackup is included as it's the initial processing point for backupName which, if stored unsanitized, led to XSS downstream.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.