Path Traversal Vulnerability in Typemill by Typemill

CVE-2026-49133

What is CVE-2026-49133?

Typemill versions prior to 2.24.0 are susceptible to a path traversal vulnerability that allows authenticated users with Author-level permissions to read files outside of designated content areas. By providing specific path traversal sequences in the Storage::getFile() method with an empty folder argument, attackers can exploit this flaw to bypass security measures in Storage::getFolderPath(), thereby gaining unauthorized access to sensitive files within the server.

References