EUVD-2026-65337
GHSA-q7c6-98mw-7m48
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H maps the CVSS 4.0 AT:P condition (Mask module access required); PR:L for authenticated backend user; no confidentiality impact; low availability from file deletion.
Primary rating from Vendor (TYPO3).
CVSS VectorVendor: TYPO3
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.
AnalysisAI
Path traversal in the TYPO3 Mask extension allows authenticated backend users with Mask module access to create or delete arbitrary .html files outside the configured template directory. The flaw stems from the extension's failure to validate client-supplied template element keys before using them to construct filesystem paths for saving and deleting Mask template files. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two specific conditions: (1) the attacker must hold a valid, authenticated TYPO3 backend account (PR:L - unauthenticated access is not sufficient), and (2) that account must be explicitly granted access to the Mask module within the TYPO3 backend (reflected as AT:P in the CVSS 4.0 vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.0 reflects a calibrated balance: VI:H (high integrity on the vulnerable system) is partially offset by AT:P (a specific module-access prerequisite) and VA:L. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a TYPO3 backend account and Mask module permissions submits a crafted content element key such as '../../webroot/error_page' when saving a Mask template. The extension constructs a file path by appending '.html' to the key without sanitization, causing the server to write attacker-controlled HTML content to a file outside the template directory - for example, overwriting an existing error page or creating a new web-accessible file. … |
| Remediation | The primary remediation is to upgrade to the patched version of the TYPO3 Mask extension as specified in the vendor advisory at https://typo3.org/security/advisory/typo3-ext-sa-2026-017 - the exact fixed version number must be confirmed there, as it was not included in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today