CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
CVE details

CVE-2025-59022

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

Score
7.1 high
Published
2026-01-13
Links
NVD · cve.org · Report wrong data

Matched ports (5)

PortPackageVersionStatusMaintainer
www/typo3-11typo3-11-php8211.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8311.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8411.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8511.5.40_1unaddressedfreebsd-ports@charlieroot.de
www/typo3-11typo3-11-php8611.5.40_1unaddressedfreebsd-ports@charlieroot.de

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>typo3-11-php82</name>
	<range><lt>10.4.55</lt></range>
      </package>
      <package>
	<name>typo3-11-php83</name>
	<range><lt>10.4.55</lt></range>
      </package>
      <package>
	<name>typo3-11-php84</name>
	<range><lt>10.4.55</lt></range>
      </package>
      <package>
	<name>typo3-11-php85</name>
	<range><lt>10.4.55</lt></range>
      </package>
      <package>
	<name>typo3-11-php86</name>
	<range><lt>10.4.55</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>Backend users who had access to the recycler module could delete
	arbitrary data from any database table defined in the TCA - regardless
	of whether they had permission to that particular table. This allowed
	attackers to purge and destroy critical site data, effectively
	rendering the website unavailable. This issue affects TYPO3 CMS
	versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40,
	13.0.0-13.4.22 and 14.0.0-14.0.1.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2025-59022</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2025-59022</url>
    </references>
    <dates>
      <discovery>2026-01-13</discovery>
      <entry>2026-10-26</entry>
    </dates>
  </vuln>