Access Protection Bypass in TYPO3 Extension from TYPO3
CVE-2026-112069

6.3MEDIUM

Key Information:

Vendor

Typo3

Status
Extension "fal Protect"
Vendor
CVE Published:
20 October 2026

What is CVE-2026-112069?

The vulnerability in the TYPO3 extension arises from inadequate access protection for files in file storages when a non-default relative base path is utilized. Consequently, these files can be served directly by the web server without proper authentication or permission checks, potentially exposing sensitive data. This issue exclusively affects websites operating on TYPO3 version 14.3.

Affected Version(s)

Extension "FAL Protect" 1.7.1 < 1.8.2

References

https://typo3.org/security/advisory/typo3-ext-sa-2026-028
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sascha Löffler
Xavier Perseguers
.