TYPO3 CMS - Broken Access Control in Media Module
CVE-2026-49742

7.1HIGH

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
9 June 2026

What is CVE-2026-49742?

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected Version(s)

TYPO3 CMS 11.0.0 < 11.5.51

TYPO3 CMS 12.0.0 < 12.4.46

TYPO3 CMS 13.0.0 < 13.4.31

References

https://typo3.org/security/advisory/typo3-core-sa-2026-013
vendor-advisory
https://github.com/TYPO3/typo3/commit/caa6b444d7ab1bdd1eb...
patch
https://github.com/TYPO3/typo3/commit/ad636b6183843b57c75...
patch

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Hyunseo Shin
Torben Hansen
.