CVE-2026-49738 json
TYPO3 CMS - Broken Access Control in File Abstraction Layer
published 5mo ago modified 2mo ago also GHSA-jf56-v8jc-jcc5 , EUVD-2026-35400
- cvss
- 2.1
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 29%
- public exploits
- 0
- none known
Summary
The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
Patch / fix
- packagist typo3/cms-core 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
- TYPO3 TYPO3 CMS 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
- github.com/TYPO3/typo3@44c2fa9 commit
- github.com/TYPO3/typo3@150a983 commit
Is CVE-2026-49738 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 29% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 2.1 | CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | <10.4.57 >=11.0.0, <11.5.51 >=12.0.0, <12.4.46 >=13.0.0, <13.4.31 >=14.0.0, <14.3.3 |
10.4.57 11.5.51 12.4.46 13.4.31 14.3.3 |
Affected products
- TYPO3 TYPO3 CMS
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/TYPO3/typo3/commit/44c2fa9807944136218a0842e3051c0a379a002d
patch, web
-
github.com
/TYPO3/typo3/commit/150a983a5d687cedcfc33bbe9c335d9a13fd05e5
patch, web
-
typo3.org
/security/advisory/typo3-core-sa-2026-016
vendor-advisory, web
-
github.com
/TYPO3/typo3/security/advisories/GHSA-jf56-v8jc-jcc5
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-49738
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49738.yaml
web
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2026-49738
- GitHub Advisory GHSA-jf56-v8jc-jcc5
- NVD CVE-2026-49738
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.