What’s Vulnerable › Vulnerabilities

CVE-2016-15017: fabarea media_upload UploadFileService.php getUploadedFileList pathname traversal

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-10 · updated 2026-06-17
• Weakness: CWE-21

Description

A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.

Affected products

• fabarea media_upload: before 0.9.0 — fixed in 0.9.0

How to fix

Upgrade to a fixed version: fabarea media_upload 0.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/fabarea/media_upload/commit/b25d42a4981072321c1a363311d8ea2a4ac8763a
• https://github.com/fabarea/media_upload/issues/6
• https://github.com/fabarea/media_upload/releases/tag/0.9.0
• https://vuldb.com/?ctiid.217786
• https://vuldb.com/?id.217786
• https://github.com/fabarea/media_upload/commit/b25d42a4981072321c1a363311d8ea2a4ac8763a
• https://github.com/fabarea/media_upload/issues/6
• https://github.com/fabarea/media_upload/releases/tag/0.9.0
• https://vuldb.com/?ctiid.217786
• https://vuldb.com/?id.217786

Get alerted when CVE-2016-15017 or the next vulnerability affects your stack