CVE-2021-43563

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-10 · updated 2026-06-17

Description

An issue was discovered in the pixxio (aka pixx.io integration or DAM) extension before 1.0.6 for TYPO3. The Access Control in the bundled media browser is broken, which allows an unauthenticated attacker to perform requests to the pixx.io API for the configured API user. This allows an attacker to download various media files from the DAM system.

Affected products

Pixxio Pixx.Io: before 1.0.6 — fixed in 1.0.6

How to fix

Upgrade to a fixed version: Pixxio Pixx.Io 1.0.6. Check the vendor advisory for mitigations.

References

https://typo3.org/security/advisory/typo3-ext-sa-2021-017
https://typo3.org/security/advisory/typo3-ext-sa-2021-017

Get alerted when CVE-2021-43563 or the next vulnerability affects your stack