TYPO3 CMS EUVD-2026-35399

Exploitation requires a valid TYPO3 backend user account (confirmed by PR:L in the CVSS 4.0 vector). The attacker must be authenticated to the TYPO3 backend - frontend-only users and unauthenticated visitors cannot reach these API routes. The vulnerable endpoints (ImageProcessController and LinkController) are part of the TYPO3 backend framework and are accessible over the network (AV:N), meaning a backend user with remote access to the TYPO3 admin interface is sufficient. No special configuration, non-default feature enablement, or elevated backend role is required beyond basic backend login. The primary limiting factor is the backend credential requirement, which confines exploitation to insider threats, compromised accounts, or scenarios where backend access is granted to less-trusted parties. The impact is further bounded to file metadata disclosure (names, paths, identifiers) rather than file content exfiltration, and no integrity or availability impact is possible via this vector.

The CVSS 4.0 base score of 5.3 (Medium) is consistent with the actual risk profile. The attack vector is network (AV:N) and complexity is low (AC:L), but exploitation requires at minimum a valid TYPO3 backend account (PR:L), which significantly limits the attacker population to trusted or compromised insiders. The confidentiality impact is rated Low (VC:L) - the vulnerability discloses file metadata such as file names, paths, and identifiers, not file contents. There is no integrity or availability impact confirmed. EPSS data was not provided; given the absence of public exploit code and KEV listing, the probability of opportunistic exploitation at scale is low. The practical risk is highest in multi-tenant TYPO3 installations where multiple editorial groups share a single backend instance but should be isolated from each other's file assets - in such environments, a lower-privileged backend user could map out the file structure of other users' storage areas. Single-editor or internally-only-accessible instances carry lower practical risk. No conflict between CVSS signals and the description is observed; PR:L correctly reflects the backend authentication requirement.

An authenticated TYPO3 backend editor who has been granted access only to a specific file mount (e.g., /fileadmin/team-a/) crafts HTTP requests to the Backend API endpoints handled by ImageProcessController or LinkController, supplying file identifiers that reference paths in a restricted storage such as /fileadmin/team-b/ or a sys_file_storage assigned to another user group. Because the missing permission check was not present before patching, the backend returns file metadata - including filenames, identifiers, and directory structure - for those out-of-scope resources. No public exploit code has been identified, but the simplicity of the attack (crafting a standard authenticated API request with an arbitrary file identifier) means any backend user with knowledge of TYPO3's API structure could reproduce it without specialized tooling.