CVE-2026-47347

published 2026-06-09

CVE-2026-47347: Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed…

Priority P4 30 medium 5.3 CVSS 4.0

AV N AC L AT N PR N UI P VC N VI N VA N SC N SI L SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

Applications that use GeneralUtility::sanitizeLocalUrl to allow only local URLs are vulnerable to open redirect attacks if the URL is used after it has passed the aforementioned sanitization checks. This enables attackers to redirect users to external content and carry out phishing attacks. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
typo3	cms-core	>= 0 < 10.4.57	10.4.57
typo3	cms-core	>= 11.0.0 < 11.5.51	11.5.51
typo3	cms-core	>= 12.0.0 < 12.4.46	12.4.46
typo3	cms-core	>= 13.0.0 < 13.4.31	13.4.31
typo3	cms-core	>= 14.0.0 < 14.3.3	14.3.3
typo3	typo3_cms	< 10.4.57	10.4.57
typo3	typo3_cms	>= 11.0.0 < 11.5.51	11.5.51
typo3	typo3_cms	>= 12.0.0 < 12.4.46	12.4.46
typo3	typo3_cms	>= 13.0.0 < 13.4.31	13.4.31
typo3	typo3_cms	>= 14.0.0 < 14.3.3	14.3.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-601