Read the docs
TI-2017-10376 Aliases CVE-2017-14251GHSA-fh4q-hxrw-cjqq

Unrestricted File Upload vulnerability in the fileDenyPattern in…

Priority MEDIUM 42CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.

Why it matters now

EPSS 0.02312 83rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed typo3/cms (Packagist): 7.6.22, 8.7.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—typo3/cms (Packagist)7.6.0 to before 7.6.227.6.22Patch availableGHSA-fh4q-hxrw-cjqq
—typo3/cms (Packagist)8.0.0 to before 8.7.58.7.5Patch availableGHSA-fh4q-hxrw-cjqq
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • typo3/cms (Packagist) Vendor— Affected 7.6.0 to before 7.6.22 Fixed in 7.6.22 Patch available GHSA-fh4q-hxrw-cjqq
  • typo3/cms (Packagist) Vendor— Affected 8.0.0 to before 8.7.5 Fixed in 8.7.5 Patch available GHSA-fh4q-hxrw-cjqq

CPE configurations NVD · 42

CPEVersionsRoleVendor
cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*7.6.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*7.6.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*7.6.2VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*7.6.3VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*7.6.4VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*7.6.5VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*7.6.6VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*7.6.7VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*7.6.8VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.9:*:*:*:*:*:*:*7.6.9VulnerableTYPO3
  • cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:* Versions 7.6.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:* Versions 7.6.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:* Versions 7.6.2 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:* Versions 7.6.3 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:* Versions 7.6.4 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:* Versions 7.6.5 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:* Versions 7.6.6 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:* Versions 7.6.7 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:* Versions 7.6.8 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.9:*:*:*:*:*:*:* Versions 7.6.9 Vulnerable ·TYPO3
Show 32 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:typo3:typo3:7.6.10:*:*:*:*:*:*:*7.6.10VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.11:*:*:*:*:*:*:*7.6.11VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.12:*:*:*:*:*:*:*7.6.12VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.13:*:*:*:*:*:*:*7.6.13VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.14:*:*:*:*:*:*:*7.6.14VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.15:*:*:*:*:*:*:*7.6.15VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.16:*:*:*:*:*:*:*7.6.16VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.17:*:*:*:*:*:*:*7.6.17VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.18:*:*:*:*:*:*:*7.6.18VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.19:*:*:*:*:*:*:*7.6.19VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.20:*:*:*:*:*:*:*7.6.20VulnerableTYPO3
cpe:2.3:a:typo3:typo3:7.6.21:*:*:*:*:*:*:*7.6.21VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:*8.0.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*8.1.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.1.2:*:*:*:*:*:*:*8.1.2VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.2.0:*:*:*:*:*:*:*8.2.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.2.1:*:*:*:*:*:*:*8.2.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.3.0:*:*:*:*:*:*:*8.3.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.3.1:*:*:*:*:*:*:*8.3.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.4.0:*:*:*:*:*:*:*8.4.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.4.1:*:*:*:*:*:*:*8.4.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.5.0:*:*:*:*:*:*:*8.5.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.5.1:*:*:*:*:*:*:*8.5.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.6.0:*:*:*:*:*:*:*8.6.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.6.1:*:*:*:*:*:*:*8.6.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.7.0:*:*:*:*:*:*:*8.7.0VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.7.1:*:*:*:*:*:*:*8.7.1VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.7.2:*:*:*:*:*:*:*8.7.2VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.7.3:*:*:*:*:*:*:*8.7.3VulnerableTYPO3
cpe:2.3:a:typo3:typo3:8.7.4:*:*:*:*:*:*:*8.7.4VulnerableTYPO3
  • cpe:2.3:a:typo3:typo3:7.6.10:*:*:*:*:*:*:* Versions 7.6.10 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.11:*:*:*:*:*:*:* Versions 7.6.11 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.12:*:*:*:*:*:*:* Versions 7.6.12 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.13:*:*:*:*:*:*:* Versions 7.6.13 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.14:*:*:*:*:*:*:* Versions 7.6.14 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.15:*:*:*:*:*:*:* Versions 7.6.15 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.16:*:*:*:*:*:*:* Versions 7.6.16 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.17:*:*:*:*:*:*:* Versions 7.6.17 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.18:*:*:*:*:*:*:* Versions 7.6.18 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.19:*:*:*:*:*:*:* Versions 7.6.19 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.20:*:*:*:*:*:*:* Versions 7.6.20 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:7.6.21:*:*:*:*:*:*:* Versions 7.6.21 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:* Versions 8.0.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:* Versions 8.1.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.1.2:*:*:*:*:*:*:* Versions 8.1.2 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.2.0:*:*:*:*:*:*:* Versions 8.2.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.2.1:*:*:*:*:*:*:* Versions 8.2.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.3.0:*:*:*:*:*:*:* Versions 8.3.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.3.1:*:*:*:*:*:*:* Versions 8.3.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.4.0:*:*:*:*:*:*:* Versions 8.4.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.4.1:*:*:*:*:*:*:* Versions 8.4.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.5.0:*:*:*:*:*:*:* Versions 8.5.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.5.1:*:*:*:*:*:*:* Versions 8.5.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.6.0:*:*:*:*:*:*:* Versions 8.6.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.6.1:*:*:*:*:*:*:* Versions 8.6.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.7.0:*:*:*:*:*:*:* Versions 8.7.0 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.7.1:*:*:*:*:*:*:* Versions 8.7.1 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.7.2:*:*:*:*:*:*:* Versions 8.7.2 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.7.3:*:*:*:*:*:*:* Versions 8.7.3 Vulnerable ·TYPO3
  • cpe:2.3:a:typo3:typo3:8.7.4:*:*:*:*:*:*:* Versions 8.7.4 Vulnerable ·TYPO3

Remediation

  • Fix · GHSA-fh4q-hxrw-cjqq typo3/cms (Packagist) Fixed in 7.6.22 Advisory →
  • Fix · GHSA-fh4q-hxrw-cjqq typo3/cms (Packagist) Fixed in 8.7.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-14251
  2. 2026-10-03 Alias added: GHSA-fh4q-hxrw-cjqq

References

Exploit 1

Advisory 1

Other 3

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2009-00241 The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9… CVSS 2.0HIGH 10.0
  • TI-2020-08940 Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS CVSS 3.1CRITICAL 10.0
  • TI-2011-03994 Improper authentication in TYPO3 CVSS 3.1CRITICAL 9.8
See all 217 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences