PT-2026-47746 · Typo3 · Typo3/Cms

Oliver Hader + 1 · Published 2026-06-09 · Updated 2026-06-09 · CVE-2026-49738

NVD

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-49738

Affected Products

Typo3/Cms

References · 4

• https://github.com/TYPO3/typo3/commit/44c2fa9807944136218a0842e3051c0a379a002d · Patch
• https://github.com/TYPO3/typo3/commit/150a983a5d687cedcfc33bbe9c335d9a13fd05e5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-49738 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2026-016 · Vendor Advisory