TYPO3 Improper Access Management in the File Abstraction Layer

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2013-4320 · ADVISORY
• TYPO3-CMS/core · PACKAGE
• typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003 · WEB
• typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2013-003 · Vendor Advisory

typo3/cms-core のその他の脆弱性

• CVE-2026-19418高 7.3The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started …
• CVE-2026-49742高 7.1Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via t…
• CVE-2026-49741高 8.7Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition record…
• CVE-2026-49740中 6.3TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation o…
• CVE-2026-49738低 2.1The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory sepa…