TYPO3 Broken Access Control in File Abstraction Layer (CVE-2026-49738)

Vulnerability Overview Vulnerability Name: TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer Publication Date: June 9, 2026 Vulnerability Type: Broken Access Control Severity: Low CVSS Score: 4.0 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/IA:N/SC:N/SI:N/SA:N) CVE ID: CVE-2026-49738 CWE ID: CWE-22 Affected Versions Affected Versions: - 10.0.0-10.4.56 - 11.0.0-11.5.50 - 12.0.0-12.4.45 - 13.0.0-13.4.30 - 14.0.0-14.3.2 Remediation Solution: Upgrade to the following versions to fix the issue: - 10.4.57 ELTS - 11.5.51 ELTS - 12.4.46 ELTS - 13.4.31 LTS - 14.3.3 LTS Description The path allowed check performed in uses a simple string prefix comparison without requiring a directory separator boundary. This allows paths such as to be incorrectly accepted as valid when the project root is . Administrators with access to the File Abstraction Layer can create new file storage definitions pointing to directories outside the project root, thereby bypassing this path check. Recommendations Follow the recommendations outlined in the . Subscribe to the mailing list. General Notes All security-related code changes have been tagged so that you can easily locate them in our review system. Author Information Author: Oliver Hader Position: Core Developer at TYPO3 GmbH, Hof, Germany Biography: Oliver has been using TYPO3 since 2005 and has been a core team member since 2007. In 20914, he returned to university to pursue a graduate master's degree in internet network science, where he currently researches advanced web technology topics, particularly TYPO3. In his spare time, he enjoys mountain biking in the hills of northern Bavaria, near Hof (Germany). Footer Information Copyright: © 2026 TYPO3 Association. Legal Notice: Legal Notice Privacy Policy: Privacy Policy Language Selection: Language

Goal Reached Thanks to every supporter — we hit 100%!

TYPO3 Broken Access Control in File Abstraction Layer (CVE-2026-49738)