Packagist/typo3/cms-recycler CVE-2025-59022: high, EPSS 0.42%

TYPO3 CMS Allows Broken Access Control in Recycler Module

Action: Upgrade typo3/cms-recycler to 10.4.55 or later.

composer require typo3/cms-recycler:14.0.2

composer require typo3/cms-recycler:13.4.23

composer require typo3/cms-recycler:12.4.41

composer require typo3/cms-recycler:11.5.49

composer require typo3/cms-recycler:10.4.55

Affected

Fixed versions

Sources

• osv: GHSA-p52w-7rhw-9m67
• https://github.com/TYPO3/typo3/security/advisories/GHSA-p52w-7rhw-9m67
• https://nvd.nist.gov/vuln/detail/CVE-2025-59022
• https://github.com/TYPO3/typo3/commit/336d6f165458a0ce32d8330999ab9ab6a5983d20
• https://github.com/TYPO3/typo3/commit/a6604db66499710f72ae6e7006beb14ad0913aae
• https://github.com/TYPO3/typo3/commit/efb9528f9882ac924c40598ebd8508479e9950a3
• https://github.com/TYPO3/typo3
• https://typo3.org/security/advisory/typo3-core-sa-2026-003

CVE-2025-59022 · published 2026-01-13T20:37:44Z · modified 2026-02-03T03:00:57.463046Z · JSON