Extension Mask
Monthly
Path traversal in the TYPO3 Mask extension allows authenticated backend users with Mask module access to create or delete arbitrary .html files outside the configured template directory. The flaw stems from the extension's failure to validate client-supplied template element keys before using them to construct filesystem paths for saving and deleting Mask template files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity impact is concrete - an attacker can overwrite or remove .html files anywhere the TYPO3 web process has write access.
Path traversal in the TYPO3 Mask extension allows authenticated backend users with Mask module access to create or delete arbitrary .html files outside the configured template directory. The flaw stems from the extension's failure to validate client-supplied template element keys before using them to construct filesystem paths for saving and deleting Mask template files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity impact is concrete - an attacker can overwrite or remove .html files anywhere the TYPO3 web process has write access.