Extension Fal Protect
Monthly
The TYPO3 extension "FAL Protect" fails to enforce its access protection on files stored in file storages configured with a non-default relative base path, allowing those files to be fetched straight from the web server without any authentication or permission check. The flaw only manifests on websites running TYPO3 14.3 that use such a non-default storage configuration; default relative base paths are not affected, and no public exploit code or confirmed active exploitation was identified at the time of analysis. Impact is limited to confidentiality - unauthenticated remote attackers can read protected files but cannot modify or delete them - making this a genuine but moderate-priority issue rather than a critical emergency.
The TYPO3 extension "FAL Protect" fails to enforce its access protection on files stored in file storages configured with a non-default relative base path, allowing those files to be fetched straight from the web server without any authentication or permission check. The flaw only manifests on websites running TYPO3 14.3 that use such a non-default storage configuration; default relative base paths are not affected, and no public exploit code or confirmed active exploitation was identified at the time of analysis. Impact is limited to confidentiality - unauthenticated remote attackers can read protected files but cannot modify or delete them - making this a genuine but moderate-priority issue rather than a critical emergency.