CVE-2026-49742: 
PHP Analyse et atténuation des vulnérabilités

CVE-2026-49742 is a broken access control vulnerability in TYPO3 CMS that allows authenticated backend users with file download permissions to download arbitrary files from the server's document root via the Media Module's fallback storage in the File Abstraction Layer (FAL). Disclosed on June 9, 2026, it affects TYPO3 CMS versions 11.0.0–11.5.50, 12.0.0–12.4.45, 13.0.0–13.4.30, and 14.0.0–14.3.2. The vulnerability carries a CVSS v4.0 base score of 7.1 (High) (Github Advisory, TYPO3 Advisory).

The root cause is improper path restriction (CWE-22) combined with exposure of sensitive information (CWE-200) in the FileDownloadController. Files for download are passed as POST data using the schema :/folder/filename.extension; the controller retrieves files from FAL and serves them if the backend user has checkFileActionPermission() access. The FAL fallback storage (storage ID 0) resolves paths relative to the server's document root rather than a restricted media directory, meaning an attacker can reference paths such as typo3temp/var/log/ or .htpasswd to retrieve sensitive server files. The fix adds an explicit check — isFallbackStorage() — to skip any file belonging to the fallback storage before it is added to the download zip (TYPO3 Commit, Github Advisory).

Successful exploitation allows a low-privileged backend user to download sensitive server-side files — including application log files, credential files (e.g., .htpasswd), and other files accessible under the document root — that are outside the intended media storage boundaries. The impact is limited to confidentiality; there is no integrity or availability impact. Exposed log files or configuration files could facilitate further attacks such as credential harvesting or reconnaissance for deeper system compromise (Github Advisory, TYPO3 Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires an authenticated backend user account with file download permissions, limiting the attack surface to insider threats or compromised backend credentials. The EPSS score is approximately 0.036–0.459% (36th percentile), indicating a low near-term exploitation probability. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Obtain backend access: Acquire credentials for a TYPO3 backend user account that has file download permissions enabled (i.e., options.file_list.fileDownload.enabled is not set to 0).
2. Navigate to the Media Module: Log into the TYPO3 backend and open the File List or Media Module, which exposes the file download functionality via FileDownloadController.
3. Craft a malicious POST request: Submit a POST request to the FileDownloadController endpoint with the items parameter referencing files in the fallback storage (storage ID 0), using paths relative to the document root — for example: items[]=typo3temp/var/log/typo3_<hash>.log or items[]=.htpasswd.
4. Receive sensitive file download: The controller resolves the path via FAL fallback storage, passes the (insufficient) checkFileActionPermission() check, and returns the file as a ZIP archive download containing the sensitive server file (TYPO3 Commit, Github Advisory).

• Network: Unusual POST requests to the TYPO3 backend FileDownloadController endpoint containing items[] parameters referencing paths outside fileadmin/ or other configured FAL storages (e.g., typo3temp/, typo3conf/, .htpasswd).
• Logs: TYPO3 backend access logs showing file download requests for non-media file types (e.g., .log, .htpasswd, .env) from the Media Module; ZIP download responses (Content-Type: application/zip) triggered by backend users for unexpected file paths.
• File System: Unexpected access timestamps on sensitive files such as typo3temp/var/log/*.log, typo3conf/LocalConfiguration.php, or .htpasswd coinciding with backend user activity.

TYPO3 has released patched versions that resolve this issue: 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, and 14.3.3 LTS. Upgrading to one of these versions is the recommended remediation. As an interim workaround, administrators should restrict file download permissions for backend users to only those who require this access by setting options.file_list.fileDownload.enabled = 0 in TSconfig for non-essential users, and audit which backend accounts currently hold file download permissions (Github Advisory, TYPO3 Advisory).

TYPO3 credited security researcher Hyunseo Shin for reporting the issue and TYPO3 security team member Torben Hansen for developing the fix, as noted in the official GitHub advisory. No significant broader media coverage or notable community commentary beyond the vendor advisory has been identified at this time (Github Advisory).