CVE-2026-49738 Details
Description
The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
A broken access control vulnerability has been identified in TYPO3 CMS within the GeneralUtility component. The issue arises from the path validation method 'isAllowedAbsPath()', which performed a simple string prefix check without enforcing a directory separator boundary. This flaw allowed paths like '/var/www/html-other/secret.yaml' to be mistakenly recognized as valid when the project root was set to '/var/www/html'. As a result, administrators with access to the File Abstraction Layer could create file storage definitions pointing to directories outside the project root, effectively bypassing the intended path restrictions. This vulnerability affects TYPO3 CMS versions prior to 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
Users are advised to update TYPO3 to versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS or 14.3.3 LTS, all of which address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 9, 2026CISA-ADP
Assessed Jun 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TYPO3/typo3/commit/150a983a5d687cedcfc33bbe9c335d9a13fd05e5 | TYPO3 | Source CodeVendor |
| https://github.com/TYPO3/typo3/commit/44c2fa9807944136218a0842e3051c0a379a002d | TYPO3 | Source CodeVendor |
| https://typo3.org/security/advisory/typo3-core-sa-2026-016 | TYPO3 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 | >= 10.0.0, <= 10.4.56 (semver) >= 11.0.0, <= 11.5.50 (semver) >= 12.0.0, <= 12.4.45 (semver) >= 13.0.0, <= 13.4.30 (semver) >= 14.0.0, <= 14.3.2 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Translated | [email protected] |
| Jul 15, 2026 | CVE Modified | TYPO3 |
| Jun 17, 2026 | CVE Modified | TYPO3 |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 9, 2026 | New CVE Received | TYPO3 |