CVE-2026-49742
CVE-2026-49742 · TYPO3 CMS - Broken Access Control in Media Module
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
CVSS 7.1 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
typo3 cms
- Versions
- ≥ 11.0.0, < 11.5.51: Affected (semver)
- ≥ 12.0.0, < 12.4.46: Affected (semver)
- ≥ 13.0.0, < 13.4.31: Affected (semver)
- ≥ 14.0.0, < 14.3.3: Affected (semver)
Update to 11.5.51; Update to 12.4.46; Update to 13.4.31; Update to 14.3.3
typo3/cms-core Packagist
- Versions
- v11.0.0
- v11.1.0
- v11.1.1
- v11.2.0
- v11.3.0
- v11.3.1
- v11.3.2
- v11.3.3
- v11.4.0
- v11.5.0
- v11.5.1
- v11.5.10
- v11.5.11
- v11.5.12
- v11.5.13
- v11.5.14
- v11.5.15
- v11.5.16
- v11.5.17
- v11.5.18
- v11.5.19
- v11.5.2
- v11.5.20
- v11.5.21
- v11.5.22
- v11.5.23
- v11.5.24
- v11.5.25
- v11.5.26
- v11.5.27
- v11.5.28
- v11.5.29
- v11.5.3
- v11.5.30
- v11.5.31
- v11.5.32
- v11.5.33
- v11.5.34
- v11.5.35
- v11.5.36
- v11.5.37
- v11.5.38
- v11.5.39
- v11.5.4
- v11.5.40
- v11.5.41
- v11.5.5
- v11.5.6
- v11.5.7
- v11.5.8
- v11.5.9
- Affected ranges
- ECOSYSTEM: ≥ 11.0.0, < 11.5.51
Update to 11.5.51
typo3/cms-core Packagist
- Versions
- v12.0.0
- v12.1.0
- v12.1.1
- v12.1.2
- v12.1.3
- v12.2.0
- v12.3.0
- v12.4.0
- v12.4.1
- v12.4.10
- v12.4.11
- v12.4.12
- v12.4.13
- v12.4.14
- v12.4.15
- v12.4.16
- v12.4.17
- v12.4.18
- v12.4.19
- v12.4.2
- v12.4.20
- v12.4.21
- v12.4.22
- v12.4.23
- v12.4.24
- v12.4.25
- v12.4.26
- v12.4.27
- v12.4.28
- v12.4.29
- v12.4.3
- v12.4.30
- v12.4.31
- v12.4.32
- v12.4.33
- v12.4.34
- v12.4.35
- v12.4.36
- v12.4.37
- v12.4.38
- v12.4.39
- v12.4.4
- v12.4.40
- v12.4.41
- v12.4.42
- v12.4.43
- v12.4.44
- v12.4.45
- v12.4.5
- v12.4.6
- v12.4.7
- v12.4.8
- v12.4.9
- Affected ranges
- ECOSYSTEM: ≥ 12.0.0, < 12.4.46
Update to 12.4.46
typo3/cms-core Packagist
- Versions
- v13.0.0
- v13.0.1
- v13.1.0
- v13.1.1
- v13.2.0
- v13.2.1
- v13.3.0
- v13.3.1
- v13.4.0
- v13.4.1
- v13.4.10
- v13.4.11
- v13.4.12
- v13.4.13
- v13.4.14
- v13.4.15
- v13.4.16
- v13.4.17
- v13.4.18
- v13.4.19
- v13.4.2
- v13.4.20
- v13.4.21
- v13.4.22
- v13.4.23
- v13.4.24
- v13.4.25
- v13.4.26
- v13.4.27
- v13.4.28
- v13.4.29
- v13.4.3
- v13.4.30
- v13.4.4
- v13.4.5
- v13.4.6
- v13.4.7
- v13.4.8
- v13.4.9
- Affected ranges
- ECOSYSTEM: ≥ 13.0.0, < 13.4.31
Update to 13.4.31
typo3/cms-core Packagist
- Versions
- v14.0.0
- v14.0.1
- v14.0.2
- v14.1.0
- v14.1.1
- v14.2.0
- v14.3.0
- v14.3.1
- v14.3.2
- Affected ranges
- ECOSYSTEM: ≥ 14.0.0, < 14.3.3
Update to 14.3.3
typo3/cms-filelist Packagist
- Versions
- v11.0.0
- v11.1.0
- v11.1.1
- v11.2.0
- v11.3.0
- v11.3.1
- v11.3.2
- v11.3.3
- v11.4.0
- v11.5.0
- v11.5.1
- v11.5.10
- v11.5.11
- v11.5.12
- v11.5.13
- v11.5.14
- v11.5.15
- v11.5.16
- v11.5.17
- v11.5.18
- v11.5.19
- v11.5.2
- v11.5.20
- v11.5.21
- v11.5.22
- v11.5.23
- v11.5.24
- v11.5.25
- v11.5.26
- v11.5.27
- v11.5.28
- v11.5.29
- v11.5.3
- v11.5.30
- v11.5.31
- v11.5.32
- v11.5.33
- v11.5.34
- v11.5.35
- v11.5.36
- v11.5.37
- v11.5.38
- v11.5.39
- v11.5.4
- v11.5.40
- v11.5.41
- v11.5.5
- v11.5.6
- v11.5.7
- v11.5.8
- v11.5.9
- Affected ranges
- ECOSYSTEM: ≥ 11.0.0, < 11.5.51
Update to 11.5.51
typo3/cms-filelist Packagist
- Versions
- v12.0.0
- v12.1.0
- v12.1.1
- v12.1.2
- v12.1.3
- v12.2.0
- v12.3.0
- v12.4.0
- v12.4.1
- v12.4.10
- v12.4.11
- v12.4.12
- v12.4.13
- v12.4.14
- v12.4.15
- v12.4.16
- v12.4.17
- v12.4.18
- v12.4.19
- v12.4.2
- v12.4.20
- v12.4.21
- v12.4.22
- v12.4.23
- v12.4.24
- v12.4.25
- v12.4.26
- v12.4.27
- v12.4.28
- v12.4.29
- v12.4.3
- v12.4.30
- v12.4.31
- v12.4.32
- v12.4.33
- v12.4.34
- v12.4.35
- v12.4.36
- v12.4.37
- v12.4.38
- v12.4.39
- v12.4.4
- v12.4.40
- v12.4.41
- v12.4.42
- v12.4.43
- v12.4.44
- v12.4.45
- v12.4.5
- v12.4.6
- v12.4.7
- v12.4.8
- v12.4.9
- Affected ranges
- ECOSYSTEM: ≥ 12.0.0, < 12.4.46
Update to 12.4.46
typo3/cms-filelist Packagist
- Versions
- v13.0.0
- v13.0.1
- v13.1.0
- v13.1.1
- v13.2.1
- v13.3.0
- v13.3.1
- v13.4.0
- v13.4.1
- v13.4.10
- v13.4.11
- v13.4.12
- v13.4.13
- v13.4.14
- v13.4.15
- v13.4.16
- v13.4.17
- v13.4.18
- v13.4.19
- v13.4.2
- v13.4.20
- v13.4.21
- v13.4.22
- v13.4.23
- v13.4.24
- v13.4.25
- v13.4.26
- v13.4.27
- v13.4.28
- v13.4.29
- v13.4.3
- v13.4.30
- v13.4.4
- v13.4.5
- v13.4.6
- v13.4.7
- v13.4.8
- v13.4.9
- Affected ranges
- ECOSYSTEM: ≥ 13.0.0, < 13.4.31
Update to 13.4.31
typo3/cms-filelist Packagist
- Versions
- v14.0.0
- v14.0.1
- v14.0.2
- v14.1.0
- v14.1.1
- v14.2.0
- v14.3.0
- v14.3.1
- v14.3.2
- Affected ranges
- ECOSYSTEM: ≥ 14.0.0, < 14.3.3
Update to 14.3.3