EUVD-2026-35403
GHSA-chm7-4vch-h8vr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to TYPO3 backend
-
DeliveryOpen Media Module file download
-
ExploitSubmit items resolving to fallback storage
-
ExecutionFAL packages document-root files into ZIP
-
ImpactExfiltrate logs, .htpasswd, or configuration secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Attacker must hold a valid TYPO3 backend account with the 'file download' permission enabled (PR:L in the CVSS vector) and reachable access to the TYPO3 backend (typically /typo3/) over HTTP/HTTPS. No user interaction is required (UI:N) and no special non-default configuration is needed - the fallback storage exists in default installations as storage ID 0. Exploitation is limited by the requirement for an authenticated backend session with the download role, so anonymous internet attackers cannot trigger it directly; impact is also confined to confidentiality (VI:N/VA:N), meaning the attacker reads files but does not modify or crash the system. |
| Impact | CVSS:4.0 7.1 with AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N reflects a network-reachable, low-complexity, low-privilege confidentiality-only impact, which matches the requirement for an authenticated backend user holding the file-download permission - not an anonymous attacker. There is no CISA KEV listing, no public exploit identified at time of analysis, and EPSS data was not provided, so real-world exploitation pressure appears low; however, the trivial mechanics and the value of leakable secrets (DB credentials in LocalConfiguration, .htpasswd, log files) make this a credible insider-abuse and post-compromise privilege-escalation primitive. The CVSS network vector is consistent with the description because TYPO3 backends are HTTP-reachable, but exploitation still hinges on a valid backend account with file download rights - defenders should weigh this as a privilege-boundary bypass rather than a remote unauthenticated RCE. |
| Exploit ScenarioDerived | A backend editor with the file-download permission opens the Media Module, selects items resolving to fallback storage paths such as 'typo3temp/var/log/' or '.htpasswd', and triggers the ZIP download endpoint. The FileDownloadController packages those server-root-relative files into the ZIP and returns it, handing the editor log files, hashed credentials, or other sensitive material outside the intended fileadmin scope; no public POC has been identified, but the merged functional test handleRequestReturnsNoFilesWhenFilesInFallbackStorage demonstrates the exact request shape that previously succeeded. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Information disclosure in TYPO3 CMS allows authenticated backend users with file download permissions to retrieve arbitrary files from the server's document root via the Media Module's File Abstraction Layer (FAL) fallback storage. Affected branches span versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2, with no public exploit identified at time of analysis. The flaw exposes sensitive files such as logs, .htpasswd, and configuration material that would normally sit outside the managed file storage.
RemediationAI
Upgrade TYPO3 CMS to a fixed branch release beyond the affected ranges - i.e., a release later than 11.5.50, 12.4.45, 13.4.30, or 14.3.2 - per TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-013 (https://typo3.org/security/advisory/typo3-core-sa-2026-013); released patched versions for each branch should be taken from that advisory. The upstream fix (commits ad636b6 and caa6b44 in TYPO3/typo3) makes FileDownloadController::collectFiles skip any file whose storage reports isFallbackStorage(), so administrators verifying a backport should confirm that check is present. As a compensating control until patching, revoke the file-download permission from non-essential backend user groups, restrict backend access (path /typo3/) to trusted IPs via web server ACLs, and audit recent download activity in sys_log; note that revoking download rights will block legitimate editors from retrieving media, so scope the restriction to operators who actually need fallback-storage-adjacent access.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TYPO3's File Abstraction Layer (FAL) defines a 'fallback storage' (storage ID 0) that resolves paths relative to the web server's document root rather than to a sandboxed fileadmin directory. The FileDownloadController in the filelist system extension (typo3/sysext/filelist/Classes/Controller/FileDownloadController.php) did not exclude fallback-storage file objects when assembling a ZIP for download, so requested items like 'typo3temp/var/log/' or '.htpasswd' could be resolved and packaged. This is a classic CWE-22 (Path Traversal / improper limitation of a pathname to a restricted directory) realized through a missing storage-type check rather than through traditional '../' sequences.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (f4fb688c-4412-4426-b4b8-421ecf27b14a) · only source for this CVE.
CVSS VectorVendor: f4fb688c-4412-4426-b4b8-421ecf27b14a
Lifecycle Timeline
1DescriptionCVE.org
Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
Executive ViewAI
TYPO3 CMS versions 11 through 14 contain an information disclosure vulnerability that allows authenticated backend users to access arbitrary files including configuration data, credentials, and logs through the Media Module. Organizations operating these versions face credential exposure and potential escalation to broader system compromise if backend user accounts are compromised or misused.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict backend user file download permissions via role-based access controls; (2) disable FAL fallback storage access for non-administrative accounts; (3) implement detailed audit logging of Media Module operations; (4) conduct privileged access reviews and disable unnecessary backend accounts; (5) move sensitive files (.htpasswd, config, logs) outside web root.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Exploit-DB