CVE and update status of the FreeBSD ports tree3,298 unaddressed CVEs in 671 portsAll times are CET
CVE details

CVE-2025-59020

By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability to insert arbitrary data into prohibited exclude fields of a database table for which the user already has write permission for a reduced set of fields. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

Score
5.3 medium
Published
2026-01-13
Links
NVD · cve.org · Report wrong data

Matched ports (5)

PortPackageVersionStatusMaintainer
www/typo3-11typo3-11-php8211.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8311.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8411.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8511.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8611.5.40_1unaddressedfreebsd-ports@charlieroot.de

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>typo3-11-php82</name>
	<range><lt>10.4.55</lt></range>
      </package>
      <package>
	<name>typo3-11-php83</name>
	<range><lt>10.4.55</lt></range>
      </package>
      <package>
	<name>typo3-11-php84</name>
	<range><lt>10.4.55</lt></range>
      </package>
      <package>
	<name>typo3-11-php85</name>
	<range><lt>10.4.55</lt></range>
      </package>
      <package>
	<name>typo3-11-php86</name>
	<range><lt>10.4.55</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>By exploiting the defVals parameter, attackers could bypass
	field‑level access checks during record creation in the TYPO3
	backend. This gave them the ability to insert arbitrary data into
	prohibited exclude fields of a database table for which the user
	already has write permission for a reduced set of fields. This issue
	affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48,
	12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-59020</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-59020</url>
    </references>
    <dates>
      <discovery>2026-01-13</discovery>
      <entry>2026-10-27</entry>
    </dates>
  </vuln>