What’s Vulnerable › Vulnerabilities

CVE-2026-49742: TYPO3 CMS - Broken Access Control in Media Module

• Severity: high (CVSS 7.1 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-09 · updated 2026-07-23
• Weakness: CWE-22

Description

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected products

• typo3: from 11.0.0 before 11.5.51; from 12.0.0 before 12.4.46; from 13.0.0 before 13.4.31; from 14.0.0 before 14.3.3 — fixed in 11.5.51, 12.4.46, 13.4.31, 14.3.3

How to fix

Upgrade to a fixed version: typo3 11.5.51, 12.4.46, 13.4.31, 14.3.3. Check the vendor advisory for mitigations.

References

• https://github.com/TYPO3/typo3/commit/ad636b6183843b57c758a1e12174a75093ac93c3
• https://github.com/TYPO3/typo3/commit/caa6b444d7ab1bdd1eb76a68004c8be73d98e6ae
• https://typo3.org/security/advisory/typo3-core-sa-2026-013

Get alerted when CVE-2026-49742 or the next vulnerability affects your stack