Hyunseo Shin

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions prior to 10.4.57 TYPO3 CMS versions 11.0.0 through 11.5.51 TYPO3 CMS versions 12.0.0 through 12.4.46 TYPO3 CMS versions 13.0.0 through 13.4.31 TYPO3 CMS versions 14.0.0 through 14.3.3 **Description** Backend users with access to the Recycler module can restore soft-deleted records on pages or for tables they are not authorized to modify. **Recommendations** Update to version 10.4.57 or later. Update to version 11.5.52 or later. Update to version 12.4.47 or later. Update to version 13.4.32 or later. Update to version 14.3.4 or later. As a temporary workaround, restrict access to the Recycler module for unauthorized users.

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions 13.0.0 through 13.4.31 TYPO3 CMS versions 14.0.0 through 14.3.3 **Description** Backend users can move records to a different page even if they lack the necessary edit permissions on the source page. **Recommendations** Update TYPO3 CMS versions 13.0.0 through 13.4.31 to a version later than 13.4.31. Update TYPO3 CMS versions 14.0.0 through 14.3.3 to a version later than 14.3.3.

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions 11.0.0 through 11.5.50 TYPO3 CMS versions 12.0.0 through 12.4.45 TYPO3 CMS versions 13.0.0 through 13.4.30 TYPO3 CMS versions 14.0.0 through 14.3.2 **Description** Backend users with file download permissions can download files from the fallback storage of the file abstraction layer (FAL) through the Media Module. Because the fallback storage resolves paths relative to the server's document root, this can lead to the exposure of sensitive files, such as log files. **Recommendations** Update TYPO3 CMS versions 11.0.0 through 11.5.50 to a version later than 11.5.50. Update TYPO3 CMS versions 12.0.0 through 12.4.45 to a version later than 12.4.45. Update TYPO3 CMS versions 13.0.0 through 13.4.30 to a version later than 13.4.30. Update TYPO3 CMS versions 14.0.0 through 14.3.2 to a version later than 14.3.2.