CVE-2025-59015: TYPO3 CMS uses insufficient entropy when generating passwords

September 9, 2025 (updated September 10, 2025)

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.

References

github.com/TYPO3-CMS/core
github.com/TYPO3-CMS/core/commit/d2057cc7b2c2db417a2af38c30cb9da42302ab70
github.com/advisories/GHSA-p5jq-5383-qvc7
nvd.nist.gov/vuln/detail/CVE-2025-59015
typo3.org/security/advisory/typo3-core-sa-2025-019

Code Behaviors & Features

Detect and mitigate CVE-2025-59015 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →