CVE-2026-49738: TYPO3 CMS - Broken Access Control in File Abstraction Layer
Problem The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check.
Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.
Credits TYPO3 CMS thanks Wolfgang Klinger for reporting this issue, and to TYPO3 core & security team member Oliver Hader for fixing it.
Resources TYPO3-CORE-SA-2026-016
Other sources
The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
— MITRE
The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 14.3.3 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 13.4.31 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 12.4.46 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 11.5.51 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 10.4.57 - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 10.4.57 ELTS - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 11.5.51 ELTS - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 12.4.46 ELTS - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 13.4.31 LTS - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 14.3.3 LTS
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49738?
CVE-2026-49738 has a low severity rating of 2.1 on the CVSS scale.
How do I fix CVE-2026-49738?
To fix CVE-2026-49738, update the TYPO3 CMS to the latest version where this vulnerability has been addressed.
What type of vulnerability is CVE-2026-49738?
CVE-2026-49738 is classified as a Broken Access Control vulnerability in the File Abstraction Layer.
What is the impact of CVE-2026-49738?
The impact of CVE-2026-49738 may allow attackers to access files outside of the intended directory due to inadequate path validation.
Which software is affected by CVE-2026-49738?
CVE-2026-49738 affects TYPO3 CMS, specifically the components handled by composer/typo3/cms-core.