Typemill CVE-2026-49133

Requires a valid Author-level (or higher) Typemill account and network reachability to the Typemill admin/API surface on a vulnerable instance running a version prior to 2.24.0. The specific trigger is a request to the ControllerApiImage::getPageMedia code path (Storage::getFile()) where the folder argument is empty and the path query parameter contains traversal sequences, which bypasses the sanitization in Storage::getFolderPath(). No user interaction by another victim is needed and the attack is fully automatable, but exploitation is bounded by the authentication requirement and by filesystem permissions of the PHP process - files unreadable by the webserver user remain inaccessible.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) accurately captures a network-reachable, low-complexity authenticated read primitive with high confidentiality impact and no integrity or availability impact, scoring 7.1. PR:L is honest because the description explicitly requires Author-level credentials, which substantially limits the population of viable attackers versus an unauthenticated RCE. There is no EPSS score, KEV listing, or public POC in the provided intelligence, so this is best treated as a credentialed information-disclosure bug rather than a mass-exploitation candidate - but for any Typemill instance that allows self-registration of authors or shares author credentials broadly, the practical risk is meaningful because an attacker can pivot to read /etc/passwd, configuration files containing secrets, or the users database to escalate further.

An attacker who obtains or self-registers an Author-level account (for example on a Typemill site with open author signup or via a phished/reused credential) logs in, then issues an authenticated API request to the page-media endpoint with folder= empty and path=../../../../etc/passwd (or path traversal to the site's settings YAML containing API keys and the user database). The server resolves the file outside the content directory and returns its contents, giving the attacker offline-crackable password hashes or secrets to escalate to admin or pivot to other services; no public exploit identified at time of analysis, but the bug class is well understood and trivially reproducible from the description.