Vulnerability · Published Jun 9, 2026 · Assigned by TYPO3

CVE-2026-49738TYPO3 CMS - Broken Access Control in File Abstraction Layer

Low 2.1

In plain English

A low-severity path traversal in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)2.1Low

Exploit odds (30 days)0.4%top 70.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	typo3/cms-core	10.4.57	GHSA-jf56-v8jc-jcc5
Packagist	typo3/cms-core	11.5.51	GHSA-jf56-v8jc-jcc5
Packagist	typo3/cms-core	12.4.46	GHSA-jf56-v8jc-jcc5
Packagist	typo3/cms-core	13.4.31	GHSA-jf56-v8jc-jcc5
Packagist	typo3/cms-core	14.3.3	GHSA-jf56-v8jc-jcc5

Affected products (as reported)

Vendor	Product	Versions
TYPO3	TYPO3 CMS	0 – before 10.4.5711.0.0 – before 11.5.5112.0.0 – before 12.4.4613.0.0 – before 13.4.3114.0.0 – before 14.3.3

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-core-sa-2026-016 vendor-advisory
Git commit of main branch patch
Git commit of 13.4 branch patch