TYPO3 CMS EUVD-2026-35400

Exploitation requires an authenticated TYPO3 backend user holding the administrator role with permissions to create or modify File Abstraction Layer (FAL) storage definitions. The CVSS PR:H vector confirms this high-privilege requirement. The attack prerequisite (AT:P) further reflects that FAL storage management access must be explicitly granted or available to the attacker's account. Exploitation is limited to backend-authenticated administrators only - unauthenticated or low-privilege users (editors, authors) cannot reach the FAL storage configuration interface. Additionally, the target directory must exist at a path that shares a string prefix with the configured project root (e.g., /var/www/html-other/ when the root is /var/www/html). Exploitation is not possible against default configurations where no exploitable directory naming coincidence exists on the filesystem.

The CVSS 4.0 score of 2.1 is an accurate reflection of real-world risk. The vector AV:N/AC:L/AT:P/PR:H/UI:N indicates network reachability but is substantially constrained by PR:H (high-privilege, administrator-level access required) and AT:P (attack prerequisites present - specifically the ability to create FAL storage definitions). The confidentiality and integrity impacts are rated Low (VC:L/VI:L) with no availability impact, and there is no scope change to subsequent systems. EPSS data was not provided; however, given the high privilege barrier and narrow attack surface (only FAL-enabled backend administrators), the probability of opportunistic exploitation is extremely low. No KEV listing and no public POC further confirm this is a low-urgency finding. This issue is best characterized as a privilege boundary misconfiguration accessible only to already-trusted administrators, making it a defense-in-depth concern rather than an emergency patch priority. No conflicting signals are present - the CVSS score and description are internally consistent.

An authenticated TYPO3 backend administrator with access to the File Abstraction Layer navigates to the storage configuration area and creates a new file storage definition with a base path of /var/www/html-other/, which would previously pass the isAllowedAbsPath() prefix check since the path starts with the project root string /var/www/html. The administrator can then browse or link to files in the out-of-bounds directory - such as configuration files, credentials, or application secrets stored adjacent to the project root - through the standard TYPO3 file manager interface. No public exploit code exists at time of analysis, and the attack requires an existing authenticated high-privilege session.