TI-2026-53882 Aliases CVE-2026-77139 GHSA-q7c6-98mw-7m48

Path Traversal in extension "Mask" (mask)

LOW 27CWE-22Published 2026-08-25 · Updated 2026-08-25

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: None · High · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00437 38th percentileScored 2026-11-07

Fix Fixed Extension "Mask" (TYPO3): 9.0.11, 8.3.12

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TYPO3	Extension "Mask"	9.0.0 to before 9.0.11; before 8.3.12	9.0.11, 8.3.12	Patch available	CNA

Extension "Mask" VendorTYPO3 Affected 9.0.0 to before 9.0.11; before 8.3.12 Fixed in 9.0.11, 8.3.12 Patch available CNA

Remediation

Fix · CNA Extension "Mask" (TYPO3) Fixed in 9.0.11, 8.3.12

Timeline

2026-10-02 Threatist record created from CVE-2026-77139
2026-10-03 Alias added: GHSA-q7c6-98mw-7m48

References

Advisory 1

https://typo3.org/security/advisory/typo3-ext-sa-2026-017

TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0

See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences