N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-59016

CVE-2025-59016: TYPO3 CMS exposes sensitive information in an error message

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-59016

CVE-2025-59016:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
typo3/cms-core	composer	>= 9.0.0, < 9.5.55	12.4.37
typo3/cms-core	composer	>= 10.0.0, < 10.4.54	12.4.37
typo3/cms-core	composer	>= 11.0.0, < 11.5.48	12.4.37
typo3/cms-core	composer	>= 12.0.0, < 12.4.37	12.4.37
typo3/cms-core	composer	>= 13.0.0, < 13.4.18	13.4.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the TYPO3\CMS\Core\Resource\Driver\LocalDriver class, which is part of TYPO3's File Abstraction Layer (FAL). Multiple methods within this class perform direct file system operations using standard PHP functions like copy, rename, move_uploaded_file, unlink, and touch. The core issue is that these functions were called without the error control operator (@).

In PHP, when a file operation fails (e.g., due to permission errors, non-existent paths, or other filesystem issues), it not only returns false but also emits an E_WARNING level error. By default, TYPO3's error handler is configured to convert such warnings into exceptions to provide detailed debugging information. However, in this context, the warning messages generated by these filesystem functions include the absolute server path of the file or directory involved in the failed operation.

An authenticated backend user with permissions to perform file operations could trigger these errors, causing an exception to be thrown. The resulting error message, visible to the user, would contain the full, sensitive file path, thus disclosing information about the server's file structure.

The patch addresses this by prepending the @ operator to all the vulnerable filesystem calls within the LocalDriver.php file. This operator suppresses any warnings generated by these functions, preventing them from being caught by the error handler and thereby stopping the information disclosure, while still allowing the code to handle the false return value to throw a generic, safe exception.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.