Executive Summary

CVE-2025-9573 is a Command Injection vulnerability in the TYPO3 extension 'ns_backup' (TYPO3 Backup Plus) versions 13.0.2 and below. It occurs because the extension does not properly sanitize user input during backup creation, allowing an attacker with a valid administrator account to execute arbitrary system commands. [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with administrator privileges to execute arbitrary commands on the affected system, potentially leading to full system compromise, unauthorized data access, data loss, or disruption of services. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the TYPO3 installation is running the ns_backup extension version 13.0.2 or below. Since the vulnerability involves command injection via backup creation, monitoring logs for unusual command execution or unexpected system commands triggered by the TYPO3 backend may help detect exploitation attempts. Specific detection commands are not provided in the resources. It is recommended to verify the extension version via the TYPO3 extension manager or by inspecting the installed extensions list. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to update the ns_backup extension to version 13.0.3 or later, which contains the fix for this command injection vulnerability. This update is available via the TYPO3 extension manager, Packagist, and the TYPO3 extensions repository. Additionally, ensure that only trusted administrators have access to the TYPO3 backend, follow the TYPO3 Security Guide, and subscribe to the typo3-announce mailing list for further security updates. [1]

Useful 0 Not Useful 0