« Volver al listado

CVE-2026-49738

Estado: AplazadaBaja (2.1)—

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Typo3 — Typo3 CMSAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-49738",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-49738",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-06-09T13:42:59.723468Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 2.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "affectedData": [
        {
          "repo": "https://github.com/TYPO3/typo3",
          "vendor": "TYPO3",
          "modules": [
            "Core"
          ],
          "product": "TYPO3 CMS",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "10.4.57",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "11.0.0",
              "lessThan": "11.5.51",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "lessThan": "12.4.46",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "13.0.0",
              "lessThan": "13.4.31",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "14.0.0",
              "lessThan": "14.3.3",
              "versionType": "semver"
            }
          ],
          "packageName": "typo3/cms-core",
          "collectionURL": "https://packagist.org",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-06-09T11:16:53.247",
  "references": [
    {
      "url": "https://github.com/TYPO3/typo3/commit/150a983a5d687cedcfc33bbe9c335d9a13fd05e5",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    },
    {
      "url": "https://github.com/TYPO3/typo3/commit/44c2fa9807944136218a0842e3051c0a379a002d",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    },
    {
      "url": "https://typo3.org/security/advisory/typo3-core-sa-2026-016",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer were able to create new file storage definitions pointing to directories outside the project root, bypassing this path check. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2."
    },
    {
      "lang": "es",
      "value": "La comprobación de permiso de ruta en GeneralUtility::isAllowedAbsPath() realizó una comparación de prefijo de cadena simple sin requerir un límite de separador de directorio, lo que provocó que una ruta como /var/www/html-other/secret.yaml fuera aceptada incorrectamente como válida cuando la raíz del proyecto era /var/www/html. Los usuarios administradores con acceso a la Capa de Abstracción de Archivos pudieron crear nuevas definiciones de almacenamiento de archivos apuntando a directorios fuera de la raíz del proyecto, eludiendo esta comprobación de ruta. Este problema afecta a las versiones de TYPO3 CMS anteriores a 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 y 14.0.0-14.3.3."
    }
  ],
  "lastModified": "2026-07-23T08:10:00.137",
  "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a"
}