TYPO3 Improper Access Management in the File Abstraction Layer

Description

References

• nvd.nist.gov/vuln/detail/CVE-2013-4320 · ADVISORY
• TYPO3-CMS/core · PACKAGE
• typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003 · WEB
• typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003 · Vendor Advisory

Weitere Schwachstellen in typo3/cms-core

• CVE-2026-19418HOCH 7.3The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started …
• CVE-2026-49742HOCH 7.1Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via t…
• CVE-2026-49741HOCH 8.7Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition record…
• CVE-2026-49740MITTEL 6.3TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation o…
• CVE-2026-49738NIEDRIG 2.1The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory sepa…