Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable API with Author-level auth required (PR:L), no user interaction, deterministic traversal (AC:L); arbitrary file read yields high confidentiality only, no integrity or availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile() with an empty folder argument. Attackers can bypass traversal-prevention controls in Storage::getFolderPath() to access sensitive files.
AnalysisAI
Arbitrary file read in Typemill before 2.24.0 allows authenticated Author-level users to traverse outside the content directory by injecting traversal sequences in the path query parameter when the folder argument is empty, defeating sanitization in Storage::getFolderPath(). Reported by VulnCheck with a vendor patch shipped in 2.24.0/2.24.2; no public exploit identified at time of analysis, and the CVSS 4.0 base score of 7.1 reflects high confidentiality impact with low-privilege network access.
Technical ContextAI
Typemill is a PHP-based flat-file CMS where content and media are stored on the filesystem and brokered through a Storage class. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory): Storage::getFolderPath() implements traversal-prevention checks, but Storage::getFile() can be invoked via a controller API (the ControllerApiImage::getPageMedia path referenced in VulnCheck's advisory) with an empty folder argument, allowing crafted ../ sequences in the path parameter to escape the intended content/media directory. The affected CPE is cpe:2.3:a:typemill:typemill:*:*:*:*:*:*:*:* up to 2.24.0, and the upstream fix is commit bfbb27001acd5c56ad62166dbefe6a59798cf1c0 included in the v2.24.2 release.
RemediationAI
Upgrade to Typemill 2.24.0 or, preferably, 2.24.2 which bundles this fix together with patches for password-reset poisoning, 2FA brute force, and unique-user issues (release notes at https://github.com/typemill/typemill/releases/tag/v2.24.2; fix commit bfbb27001acd5c56ad62166dbefe6a59798cf1c0). If immediate patching is not possible, restrict who can hold Author-level accounts (disable open registration, audit and rotate existing Author credentials), and front the Typemill admin/API with a reverse-proxy rule that blocks requests to the page-media API endpoint or rejects path query parameters containing ../, .., or URL-encoded variants (%2e%2e, ..%2f) - note that blocking the media API will break legitimate image management in the editor, so this is a stopgap. Additionally, run the PHP process under a least-privileged OS user with filesystem ACLs that deny read access to system files and other webroots, limiting the blast radius of any residual traversal.
Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. Rated high sev
Reflected XSS in Typemill's login error page allows unauthenticated attackers to inject malicious scripts by crafting re
Credential brute-forcing against Typemill CMS (versions up to and including 2.25.0) is possible because its primary pass
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious Jav
Stored HTML attribute injection in Typemill versions prior to 2.23.0 allows authenticated content editors to embed arbit
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today