| Package | Affected versions | Patched versions |
|---|---|---|
| typo3/cms | ≥ 7.6.0, < 7.6.22≥ 8.0.0, < 8.7.5 | 7.6.228.7.5 |
Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload *.pht files which can be executed in certain web server setups. The new default fileDenyPattern is the following, which might have been overridden in the TYPO3 Install Tool.
\.(php[3-7]?|phpsh|phtml|pht)(\..*)?$|^\.htaccess$
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free