CVE-2021-43562

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-10 · updated 2026-06-17
Weakness: CWE-918

Description

An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The extension fails to restrict the image download to the configured pixx.io DAM URL, resulting in SSRF. As a result, an attacker can download various content from a remote location and save it to a user-controlled filename, which may result in Remote Code Execution. A TYPO3 backend user account is required to exploit this.

Affected products

Pixxio Pixx.Io: before 1.0.6 — fixed in 1.0.6

How to fix

Upgrade to a fixed version: Pixxio Pixx.Io 1.0.6. Check the vendor advisory for mitigations.

References

https://typo3.org/security/advisory/typo3-ext-sa-2021-017
https://typo3.org/security/advisory/typo3-ext-sa-2021-017

Get alerted when CVE-2021-43562 or the next vulnerability affects your stack