CVE-2025-59019: TYPO3 CSV download feature information disclosure

The provided vulnerability details and the associated patch commit directly point to a missing authorization vulnerability in the CSV download functionality of TYPO3. The commit c983415f062c32f8edbb78544a0ff3219bc35d17 modifies the RecordListDownloadController.php file, specifically within the handleDownloadRequest function. The added code explicitly introduces a permission check ($backendUser->check('tables_select', $this->table)) that was previously absent. This confirms that the handleDownloadRequest function was the entry point for the vulnerability, as it processed the download request without proper authorization. An attacker could have exploited this by crafting a request to this controller to download data from an arbitrary table. Therefore, this function would be present in any runtime profile capturing the exploitation of this information disclosure vulnerability.