TYPO3 CMS applications that use the built‑in sanitization routine GeneralUtility::sanitizeLocalUrl to permit only local URLs are vulnerable to open redirect attacks once the sanitized URL is later processed. An attacker can embed a crafted URL that passes the sanitization checks and then redirect unsuspecting users to malicious or phishing sites. The primary consequence is the potential for credential theft or delivery of malicious content, with the weakness mapped to CWE‑601: Open Redirect.

TYPO3 CMS versions prior to 10.4.57, 11.0.0‑11.5.50, 12.0.0‑12.4.45, 13.0.0‑13.4.30, and 14.0.0‑14.3.2 are affected. The vulnerability is present in the core utilities of the CMS and impacts any site that enables external links through GeneralUtility::sanitizeLocalUrl.

The CVSS score of 5.3 indicates moderate overall risk. No EPSS data is available, and the flaw is not listed in the CISA KEV catalog, suggesting a lower probability of widespread exploitation. Nevertheless, the attack vector is likely remote, via crafted URLs submitted to the web application. An attacker who can embed an external link within user‑controlled input and subsequently cause the CMS to use that link can redirect users without needing additional privileges.