Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-49742
PUBLISHED
More InfoOfficial Page
Assigner-TYPO3
Assigner Org ID-f4fb688c-4412-4426-b4b8-421ecf27b14a
View Known Exploited Vulnerability (KEV) details
Published At-09 Jun, 2026 | 10:54
Updated At-11 Jun, 2026 | 13:27
Rejected At-
▼CVE Numbering Authority (CNA)
TYPO3 CMS - Broken Access Control in Media Module

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected Products
Vendor
TYPO3 AssociationTYPO3
Product
TYPO3 CMS
Collection URL
https://packagist.org
Package Name
typo3/cms-filelist
Repo
https://github.com/TYPO3/typo3
Modules
  • Filelist
Default Status
unaffected
Versions
Affected
  • From 11.0.0 before 11.5.51 (semver)
  • From 12.0.0 before 12.4.46 (semver)
  • From 13.0.0 before 13.4.31 (semver)
  • From 14.0.0 before 14.3.3 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-22CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWECWE-200CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Type: CWE
CWE ID: CWE-22
Description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Type: CWE
CWE ID: CWE-200
Description: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
Metrics
VersionBase scoreBase severityVector
4.07.1HIGH
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Version: 4.0
Base score: 7.1
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
reporter
Hyunseo Shin
remediation developer
Torben Hansen
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://typo3.org/security/advisory/typo3-core-sa-2026-013
vendor-advisory
https://github.com/TYPO3/typo3/commit/caa6b444d7ab1bdd1eb76a68004c8be73d98e6ae
patch
https://github.com/TYPO3/typo3/commit/ad636b6183843b57c758a1e12174a75093ac93c3
patch
Hyperlink: https://typo3.org/security/advisory/typo3-core-sa-2026-013
Resource:
vendor-advisory
Hyperlink: https://github.com/TYPO3/typo3/commit/caa6b444d7ab1bdd1eb76a68004c8be73d98e6ae
Resource:
patch
Hyperlink: https://github.com/TYPO3/typo3/commit/ad636b6183843b57c758a1e12174a75093ac93c3
Resource:
patch
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Details not found