- Release Date: May 20, 2025
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: "Backup Plus" (ns_backup)
- Composer Package Name: nitsan/ns-backup
- Vulnerability Type: Command Injection, Predictable Resource Location and Cross-Site Scripting
- Affected Versions: 13.0.0 and below
- Severity: Medium
- Suggested CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C
- References: CVE-2025-48201, CVE-2025-48204, CVE-2025-48206, CWE-77, CWE-79, CWE-552
Problem Description
The extension fails to sanitize user input resulting in Command Injection when creating a backup. An authenticated backend user with access to the extensions backend module is required to exploit the vulnerability.
The extension saves backup and configuration files to a predictable resource location. This allows an unauthenticated remote user to download created backups and configuration files.
The extension fails to properly encode user input for output in HTML context in TYPO3 backend user interface.
Note: The TYPO3 Security Team recommends downloading and removing all previously created backup files to delete any files that may be affected by the Predictable Resource Location vulnerability. Additionally, it is recommended to configure a non-public accessible directory as target folder for backups.
Solution
An updated version 13.0.1 is available from the TYPO3 extension manager, packagist and at
https://extensions.typo3.org/extension/download/ns_backup/13.0.1/zip
Users of the extension are advised to update the extension as soon as possible.
Credits
Thanks to Jakub Świes and to Swiss NCSC Vulnerability Management Team for reporting the Command Injection vulnerability, Swiss NCSC Vulnerability Management Team and TYPO3 Security Team Member Torben Hansen for reporting the Predictable Resource Location vulnerability, Swiss NCSC Vulnerability Management Team for reporting the Cross-Site Scripting vulnerabilities and Sanjay Chauhan (NITSAN) for providing an updated version of the extension.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.