N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59014

CVE-2025-59014: TYPO3 Bookmark Toolbar vulnerable to denial of service

An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user interface by saving manipulated data in the bookmark toolbar.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59014

CVE-2025-59014:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-backend	composer	>= 11.0.0, < 11.5.48	12.4.37
typo3/cms-backend	composer	>= 12.0.0, < 12.4.37	12.4.37
typo3/cms-backend	composer	>= 13.0.0, < 13.4.18	13.4.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service caused by an uncaught exception when processing manipulated bookmark data in TYPO3's backend. The provided patch in commit 04db7e25de1d3bb2d082ba68f7f974ccd917cc3f clearly shows the addition of a try-catch block in the initShortcuts method of the ShortcutRepository class. This method is responsible for loading and processing user-created shortcuts. Before the patch, an exception caused by malformed data (e.g., an invalid folder identifier) would propagate up the call stack and crash the backend UI. The patch introduces a generic catch (\Throwable $e) block that catches any exception, logs it, and allows the application to continue running, thus preventing the denial of service. The primary vulnerable function is initShortcuts as it contains the flawed logic. The constructor __construct is also included as it is the direct caller of initShortcuts and represents the start of the vulnerable operation when a ShortcutRepository object is created.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.