CVE Explorer
CVE-2026-49738
The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CM
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
0
Affected products and versions
1 source assertion{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","modules":["Core"],"packageName":"typo3/cms-core","product":"TYPO3 CMS","repo":"https://github.com/TYPO3/typo3","vendor":"TYPO3","versions":[{"lessThan":"10.4.57","status":"affected","version":"0","versionType":"semver"},{"lessThan":"11.5.51","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThan":"12.4.46","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"13.4.31","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"14.3.3","status":"affected","version":"14…
- cve_program_cvelist_v5affectedurn:baitaphish:normalized-source-record:v2:7573410db60166de887f8f2cc885e9167f11429218a0c31df5dfa9aece278f7a · sha256:5c9e199997472623… · /containers/cna/affected/0
Provider-owned CVSS observations
1 source assertion{"metric":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":2.1,"baseSeverity":"LOW","exploitMaturity":"NOT_DEFINED","privilegesRequired":"HIGH","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact"…
- cve_program_cvelist_v5cvssurn:baitaphish:normalized-source-record:v2:7573410db60166de887f8f2cc885e9167f11429218a0c31df5dfa9aece278f7a · sha256:5c9e199997472623… · /containers/cna/metrics/0/cvssV4_0
CWE assertions
1 source assertion{"cweId":"CWE-22","description":"CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","lang":"en","type":"CWE"}
- cve_program_cvelist_v5cweurn:baitaphish:normalized-source-record:v2:7573410db60166de887f8f2cc885e9167f11429218a0c31df5dfa9aece278f7a · sha256:5c9e199997472623… · /containers/cna/problemTypes/0/descriptions/0
Source references
3 source assertions{"name":"Git commit of 13.4 branch","tags":["patch"],"url":"https://github.com/TYPO3/typo3/commit/150a983a5d687cedcfc33bbe9c335d9a13fd05e5"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7573410db60166de887f8f2cc885e9167f11429218a0c31df5dfa9aece278f7a · sha256:5c9e199997472623… · /containers/cna/references/2
{"name":"Git commit of main branch","tags":["patch"],"url":"https://github.com/TYPO3/typo3/commit/44c2fa9807944136218a0842e3051c0a379a002d"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7573410db60166de887f8f2cc885e9167f11429218a0c31df5dfa9aece278f7a · sha256:5c9e199997472623… · /containers/cna/references/1
{"tags":["vendor-advisory"],"url":"https://typo3.org/security/advisory/typo3-core-sa-2026-016"}
- cve_program_cvelist_v5referenceurn:baitaphish:normalized-source-record:v2:7573410db60166de887f8f2cc885e9167f11429218a0c31df5dfa9aece278f7a · sha256:5c9e199997472623… · /containers/cna/references/0
Attribution and limitations
- CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →
Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.