TI-2026-36348 Aliases CVE-2026-49133 GHSA-pvj2-mj22-xxmq

Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()

LOW 31CWE-22Published 2026-06-17 · Updated 2026-07-14

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile() with an empty folder argument. Attackers can bypass traversal-prevention controls in Storage::getFolderPath() to access sensitive files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00343 28th percentileScored 2026-11-07

Fix Fixed typemill (typemill): 2.24.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
typemill	typemill	before 2.24.0	2.24.0	Patch available	CNA

typemill Vendortypemill Affected before 2.24.0 Fixed in 2.24.0 Patch available CNA

Remediation

Fix · CNA typemill (typemill) Fixed in 2.24.0

Timeline

2026-10-02 Threatist record created from CVE-2026-49133
2026-10-03 Alias added: GHSA-pvj2-mj22-xxmq

References

Patch 1

https://github.com/typemill/typemill/commit/bfbb27001acd5c56ad62166dbefe6a59798cf1c0

Other 1

https://github.com/typemill/typemill/releases/tag/v2.24.2

TI-2026-38549 Typemill has Stored HTML Attribute Injection in Metadata Fields CVSS 3.1MEDIUM 4.6
TI-2026-49888 typemill - No Rate Limiting on Login Endpoint Enables Unlimited Password Brute-Force CVSS 3.1CRITICAL 9.1
TI-2026-50117 Typemill < 2.26.0 Authorization Bypass via Media File Download Route CVSS 4.0HIGH 8.7
TI-2022-10879 Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the… CVSS 3.1HIGH 8.8
TI-2026-19445 Typemill has Reflected XSS via login error view template CVSS 3.1MEDIUM 6.1
TI-2026-32346 Typemill CMS 2.x Persistent XSS via Markdown javascript URI CVSS 4.0MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences