FAL Protect CVE-2026-112069

Exploitable only when the fal_protect extension serves a file storage configured with a non-default relative base path AND the hosting website runs TYPO3 14.3; under those conditions the affected files are served directly by the web server with no authentication or permission check. Limiting factors that reduce realistic risk: the non-default storage configuration is required (default relative base path is not affected), the vulnerable code path is specific to TYPO3 14.3, and the CVSS 4.0 vector marks an attack requirement (AT:P), reflecting that these preconditions must hold. No user interaction or authentication is required once those conditions are met.

This is a genuine but moderate-priority issue, not a critical emergency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N) scores 6.3 (Medium): network-reachable and unauthenticated (PR:N), but with an attack requirement (AT:P) reflecting that exploitation depends on a specific, non-default deployment condition. Impact is confidentiality-only and rated Low (VC:L/VI:N/VA:N) - it exposes files that should have been access-protected but does not grant write or availability impact. No EPSS score, CISA KEV listing, or POC was provided in the input; per precision rules this means there is no public exploit identified at time of analysis and no evidence of active exploitation, so real-world risk is driven by exposure rather than observed attacks. The signals are internally consistent (unauthenticated network access offset by a required non-default configuration and version-specific scope), so there is no CVSS-versus-description conflict to flag. The main risk qualifier is that exploitability is gated by two conditions - the extension must serve file storages with a non-default relative base path, and the site must run TYPO3 14.3 - which makes this targeted/conditional rather than broadly wormable.

An unauthenticated attacker identifies a TYPO3 14.3 website using the fal_protect extension where a file storage is configured with a non-default relative base path. Because access protection is no longer applied to those files, the attacker simply requests the file's direct URL and the web server returns it with no authentication or permission check, exposing content that was intended to be restricted. No public exploit code is required or known - the 'exploit' is a direct HTTP request to a predictable path.