CVE-2026-49738 TYPO3 CMS - Broken Access Control in File Abstraction Layer
Administrators can bypass path restrictions to access files outside the project root due to flawed prefix checking in TYPO3 CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49738?
CVE-2026-49738 is a low-severity path traversal vulnerability in TYPO3 CMS, published on 9 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
Weakness: CWE-22
Which versions are affected by CVE-2026-49738?
10 open source packages ship an affected version, including typo3/cms-core.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms-core Packagist | All versions | 10.4.57 |
typo3/cms-core Packagist | All versions | 10.4.57 |
typo3/cms-core Packagist | From 11.0.0 | 11.5.51 |
typo3/cms-core Packagist | From 11.0.0 | 11.5.51 |
typo3/cms-core Packagist | From 12.0.0 | 12.4.46 |
typo3/cms-core Packagist | From 12.0.0 | 12.4.46 |
4 more packages
typo3/cms-core Packagist | From 13.0.0 | 13.4.31 |
typo3/cms-core Packagist | From 13.0.0 | 13.4.31 |
typo3/cms-core Packagist | From 14.0.0 | 14.3.3 |
typo3/cms-core Packagist | From 14.0.0 | 14.3.3 |
How do I fix CVE-2026-49738?
Upgrade typo3/cms-core to a fixed version for your release line: 10.4.57, 11.5.51, 12.4.46 or 13.4.31.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49738 being exploited?
There is no known exploitation of CVE-2026-49738 in the wild and no public exploit code.
Sources
Also known as GHSA-jf56-v8jc-jcc5.