Cyber Resilience

CVE-2025-47940

High

Published: 20 May 2025

Published
20 May 2025
Modified
03 September 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0032 55.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-47940 is a high-severity Unverified Ownership (CWE-283) vulnerability in Typo3 Typo3. Its CVSS base score is 7.2 (High).

Operationally, ranked in the top 44.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

TYPO3 is an open source, PHP based web content management system. Starting in version 10.0.0 and prior to versions 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, and 13.4.12 LTS, administrator-level backend users without system maintainer privileges can escalate their privileges and…

more

gain system maintainer access. Exploiting this vulnerability requires a valid administrator account. Users should update to TYPO3 version 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS to fix the problem.

CWE(s)
CWE-283

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

typo3
typo3
10.4.0 — 10.4.50 · 11.0.0 — 11.5.44 · 12.0.0 — 12.4.31

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References