CVE-2026-49742 TYPO3 CMS - Broken Access Control in Media Module
Authenticated backend users can download sensitive files from the server root via the Media Module due to improper path handling.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-49742?
CVE-2026-49742 is a high-severity path traversal vulnerability in TYPO3 CMS, published on 9 Jun 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
Which versions are affected by CVE-2026-49742?
16 open source packages ship an affected version, including typo3/cms-core and typo3/cms-filelist.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms-core Packagist | From 11.0.0 | 11.5.51 |
typo3/cms-core Packagist | From 11.0.0 | 11.5.51 |
typo3/cms-core Packagist | From 12.0.0 | 12.4.46 |
typo3/cms-core Packagist | From 12.0.0 | 12.4.46 |
typo3/cms-core Packagist | From 13.0.0 | 13.4.31 |
typo3/cms-core Packagist | From 13.0.0 | 13.4.31 |
10 more packages
typo3/cms-core Packagist | From 14.0.0 | 14.3.3 |
typo3/cms-core Packagist | From 14.0.0 | 14.3.3 |
typo3/cms-filelist Packagist | From 11.0.0 | 11.5.51 |
typo3/cms-filelist Packagist | From 11.0.0 | 11.5.51 |
typo3/cms-filelist Packagist | From 12.0.0 | 12.4.46 |
typo3/cms-filelist Packagist | From 12.0.0 | 12.4.46 |
typo3/cms-filelist Packagist | From 13.0.0 | 13.4.31 |
typo3/cms-filelist Packagist | From 13.0.0 | 13.4.31 |
typo3/cms-filelist Packagist | From 14.0.0 | 14.3.3 |
typo3/cms-filelist Packagist | From 14.0.0 | 14.3.3 |
How do I fix CVE-2026-49742?
Upgrade typo3/cms-core to a fixed version for your release line: 11.5.51, 12.4.46, 13.4.31 or 14.3.3.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-49742 being exploited?
There is no known exploitation of CVE-2026-49742 in the wild and no public exploit code.
Sources
Also known as GHSA-chm7-4vch-h8vr.