TYPO3 CMS has Broken Access Control in its File Abstraction Layer

低 2.1CVE-2026-49738 · GHSA-jf56-v8jc-jcc5 · 09/06/2026 公開 · 23/07/2026 更新

要点

CVE-2026-49738 は typo3/cms-core に影響する深刻度「低」 (CVSS 2.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.36%（全脆弱性の 29.3% より高い）。
対処：11.5.51, 12.4.46, 13.4.31, 14.3.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
typo3/cms-core Packagist	`≥ 11.0.0, < 11.5.51≥ 12.0.0, < 12.4.46≥ 13.0.0, < 13.4.31≥ 14.0.0, < 14.3.3< 10.4.57`	`11.5.5112.4.4613.4.3114.3.310.4.57`

概要

Problem

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check.

Solution

Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

Credits

TYPO3 CMS thanks Wolfgang Klinger for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.

Resources

TYPO3-CORE-SA-2026-016

NVD の説明

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.