Read the docs
TI-2024-38844 Aliases GHSA-r287-hc8j-w56h

TYPO3 Information Disclosure Vulnerability Exploitable by Editors

Priority LOW 38CWE-200Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Information disclosure
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.

Summary

It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account is needed to exploit this vulnerability.

Why it matters now

Fix Fixed typo3/cms (Packagist): 6.2.14, 7.3.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—typo3/cms (Packagist)6.2.0 to before 6.2.146.2.14Patch availableGHSA-r287-hc8j-w56h
—typo3/cms (Packagist)7.0.0 to before 7.3.17.3.1Patch availableGHSA-r287-hc8j-w56h
  • typo3/cms (Packagist) Vendor— Affected 6.2.0 to before 6.2.14 Fixed in 6.2.14 Patch available GHSA-r287-hc8j-w56h
  • typo3/cms (Packagist) Vendor— Affected 7.0.0 to before 7.3.1 Fixed in 7.3.1 Patch available GHSA-r287-hc8j-w56h

Remediation

  • Fix · GHSA-r287-hc8j-w56h typo3/cms (Packagist) Fixed in 6.2.14 Advisory →
  • Fix · GHSA-r287-hc8j-w56h typo3/cms (Packagist) Fixed in 7.3.1 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-r287-hc8j-w56h

References

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences