CVE-2026-49738
LowCVSS 2.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In TYPO3 CMS, the GeneralUtility::isAllowedAbsPath() function performed a plain string prefix comparison without requiring a directory separator boundary, allowing administrators with File Abstraction Layer access to create file storage definitions outside the project root.
Risk Assessment
Administrators can bypass path restrictions and access files outside the project root, leading to data disclosure.
Recommendation
Update TYPO3 CMS to version 10.4.57, 11.5.50, 12.4.45, 13.4.30, or 14.3.2 depending on the branch used.
Original NVD description (English source)
The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.