Vulnerability advisory

CVE-2019-19848

Published Dec 17, 2019Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/TYPO3/typo3 ↗
All commits before 23b71bb1059d1a1b1ddbc49caedb5ff1c14e00f3	`23b71bb1059d1a1b1ddbc49caedb5ff1c14e00f3`
41235ff8e38c6f3401df03ae8beddd62d662c525 to before efd84a5a507792083f9f4ec03f8c7d580adfc3d8	`efd84a5a507792083f9f4ec03f8c7d580adfc3d8`
c91b70e450c52d29ffb08115fffbb7832b15a330 to before b7d2c8f95222abade62827244327367995345891	`b7d2c8f95222abade62827244327367995345891`
Also listed as affected (158) `v10.2.1` `v10.2.0` `v8.7.29` `TYPO3_8-7-29` `8.7.29` `v9.5.11` `v9.5.10` `v8.7.28` `TYPO3_8-7-28` `8.7.28` `v10.1.0` `v9.5.9` `v10.0.0` `v9.5.8` `v8.7.27` `TYPO3_8-7-27` `8.7.27` `v8.7.26` `TYPO3_8-7-26` `8.7.26` `v9.5.7` `v8.7.25` `TYPO3_8-7-25` `8.7.25` `v9.5.6` `v9.5.5` `v8.7.24` `TYPO3_8-7-24` `8.7.24` `v9.5.4` `v8.7.23` `TYPO3_8-7-23` `8.7.23` `v8.7.22` `TYPO3_8-7-22` `8.7.22` `v9.5.3` `v9.5.2` `v8.7.21` `TYPO3_8-7-21` `8.7.21` `v9.5.1` `v8.7.20` `TYPO3_8-7-20` `8.7.20` `v9.5.0` `v9.4.0` `v8.7.19` `TYPO3_8-7-19` `8.7.19` `v8.7.18` `TYPO3_8-7-18` `8.7.18` `v8.7.17` `TYPO3_8-7-17` `8.7.17` `v9.3.0` `v8.7.16` `TYPO3_8-7-16` `8.7.16` `v8.7.15` `TYPO3_8-7-15` `8.7.15` `v8.7.14` `TYPO3_8-7-14` `8.7.14` `v9.2.0` `v8.7.13` `TYPO3_8-7-13` `8.7.13` `v8.7.12` `TYPO3_8-7-12` `8.7.12` `v8.7.11` `TYPO3_8-7-11` `8.7.11` `v8.7.10` `TYPO3_8-7-10` `8.7.10` `v9.1.0` `v9.0.0` `v8.7.9` `TYPO3_8-7-9` `8.7.9` `v8.7.8` `TYPO3_8-7-8` `8.7.8` `v8.7.7` `TYPO3_8-7-7` `8.7.7` `v8.7.6` `TYPO3_8-7-6` `8.7.6` `v8.7.5` `TYPO3_8-7-5` `8.7.5` `v8.7.4` `TYPO3_8-7-4` `8.7.4` `TYPO3_8-7-2` `8.7.2` `TYPO3_8-7-1` `8.7.1` `TYPO3_8-7-0` `8.7.0` `TYPO3_8-6-0` `8.6.0` `TYPO3_8-5-0` `8.5.0` `TYPO3_8-4-0` `8.4.0` `TYPO3_8-3-0` `8.3.0` `TYPO3_8-2-0` `8.2.0` `TYPO3_8-1-0` `8.1.0` `TYPO3_8-0-0` `8.0.0` `TYPO3_7-6-2` `7.6.2` `TYPO3_7-6-1` `7.6.1` `TYPO3_7-6-0` `7.6.0` `TYPO3_7-5-0` `7.5.0` `TYPO3_7-4-0` `7.4.0` `TYPO3_7-3-0` `7.3.0` `TYPO3_7-2-0` `7.2.0` `TYPO3_7-1-0` `7.1.0` `TYPO3_7-0-0` `7.0.0` `TYPO3_6-2-3` `6.2.3` `TYPO3_6-2-2` `6.2.2` `TYPO3_6-2-1` `6.2.1` `TYPO3_6-2-0` `6.2.0` `TYPO3_6-2-0rc2` `TYPO3_6-2-0rc1` `TYPO3_6-2-0beta7` `TYPO3_6-2-0beta6` `TYPO3_6-2-0beta5` `TYPO3_6-2-0beta4` `TYPO3_6-2-0beta3` `TYPO3_6-2-0beta2` `TYPO3_6-2-0beta1` `TYPO3_6-2-0alpha3` `TYPO3_6-2-0alpha2` `TYPO3_6-2-0alpha1` `TYPO3_6-1-0rc1`
GIT github.com/typo3/typo3 ↗
All commits before 23b71bb1059d1a1b1ddbc49caedb5ff1c14e00f3	`23b71bb1059d1a1b1ddbc49caedb5ff1c14e00f3`
41235ff8e38c6f3401df03ae8beddd62d662c525 to before efd84a5a507792083f9f4ec03f8c7d580adfc3d8	`efd84a5a507792083f9f4ec03f8c7d580adfc3d8`
c91b70e450c52d29ffb08115fffbb7832b15a330 to before b7d2c8f95222abade62827244327367995345891	`b7d2c8f95222abade62827244327367995345891`
Also listed as affected (158) `v10.2.1` `v10.2.0` `v8.7.29` `TYPO3_8-7-29` `8.7.29` `v9.5.11` `v9.5.10` `v8.7.28` `TYPO3_8-7-28` `8.7.28` `v10.1.0` `v9.5.9` `v10.0.0` `v9.5.8` `v8.7.27` `TYPO3_8-7-27` `8.7.27` `v8.7.26` `TYPO3_8-7-26` `8.7.26` `v9.5.7` `v8.7.25` `TYPO3_8-7-25` `8.7.25` `v9.5.6` `v9.5.5` `v8.7.24` `TYPO3_8-7-24` `8.7.24` `v9.5.4` `v8.7.23` `TYPO3_8-7-23` `8.7.23` `v8.7.22` `TYPO3_8-7-22` `8.7.22` `v9.5.3` `v9.5.2` `v8.7.21` `TYPO3_8-7-21` `8.7.21` `v9.5.1` `v8.7.20` `TYPO3_8-7-20` `8.7.20` `v9.5.0` `v9.4.0` `v8.7.19` `TYPO3_8-7-19` `8.7.19` `v8.7.18` `TYPO3_8-7-18` `8.7.18` `v8.7.17` `TYPO3_8-7-17` `8.7.17` `v9.3.0` `v8.7.16` `TYPO3_8-7-16` `8.7.16` `v8.7.15` `TYPO3_8-7-15` `8.7.15` `v8.7.14` `TYPO3_8-7-14` `8.7.14` `v9.2.0` `v8.7.13` `TYPO3_8-7-13` `8.7.13` `v8.7.12` `TYPO3_8-7-12` `8.7.12` `v8.7.11` `TYPO3_8-7-11` `8.7.11` `v8.7.10` `TYPO3_8-7-10` `8.7.10` `v9.1.0` `v9.0.0` `v8.7.9` `TYPO3_8-7-9` `8.7.9` `v8.7.8` `TYPO3_8-7-8` `8.7.8` `v8.7.7` `TYPO3_8-7-7` `8.7.7` `v8.7.6` `TYPO3_8-7-6` `8.7.6` `v8.7.5` `TYPO3_8-7-5` `8.7.5` `v8.7.4` `TYPO3_8-7-4` `8.7.4` `TYPO3_8-7-2` `8.7.2` `TYPO3_8-7-1` `8.7.1` `TYPO3_8-7-0` `8.7.0` `TYPO3_8-6-0` `8.6.0` `TYPO3_8-5-0` `8.5.0` `TYPO3_8-4-0` `8.4.0` `TYPO3_8-3-0` `8.3.0` `TYPO3_8-2-0` `8.2.0` `TYPO3_8-1-0` `8.1.0` `TYPO3_8-0-0` `8.0.0` `TYPO3_7-6-2` `7.6.2` `TYPO3_7-6-1` `7.6.1` `TYPO3_7-6-0` `7.6.0` `TYPO3_7-5-0` `7.5.0` `TYPO3_7-4-0` `7.4.0` `TYPO3_7-3-0` `7.3.0` `TYPO3_7-2-0` `7.2.0` `TYPO3_7-1-0` `7.1.0` `TYPO3_7-0-0` `7.0.0` `TYPO3_6-2-3` `6.2.3` `TYPO3_6-2-2` `6.2.2` `TYPO3_6-2-1` `6.2.1` `TYPO3_6-2-0` `6.2.0` `TYPO3_6-2-0rc2` `TYPO3_6-2-0rc1` `TYPO3_6-2-0beta7` `TYPO3_6-2-0beta6` `TYPO3_6-2-0beta5` `TYPO3_6-2-0beta4` `TYPO3_6-2-0beta3` `TYPO3_6-2-0beta2` `TYPO3_6-2-0beta1` `TYPO3_6-2-0alpha3` `TYPO3_6-2-0alpha2` `TYPO3_6-2-0alpha1` `TYPO3_6-1-0rc1`

Description

An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)

CVE-2019-19848

Affected versions

Repository

Description

References