Vulnerability advisory

CVE-2026-49742

TYPO3 CMS - Broken Access Control in Media Module

Published Jun 9, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
fd8745e46bb11773e85524b8ee9650dabe340713 to before 59bfeaaf0136dfe17011786ce825884e48bedc8d	`59bfeaaf0136dfe17011786ce825884e48bedc8d`
6d6bd23afff6a48ee3efeaa68eb829820397d6a1 to before e16ec78165a7d60f09dcac04bfbb309409e174b3	`e16ec78165a7d60f09dcac04bfbb309409e174b3`
Not specified	`caa6b444d7ab1bdd1eb76a68004c8be73d98e6ae`
Not specified	`ad636b6183843b57c758a1e12174a75093ac93c3`
Also listed as affected (42) `v14.3.2` `v13.4.30` `v14.3.1` `v13.4.29` `v14.3.0` `v13.4.28` `v14.2.0` `v13.4.27` `v13.4.26` `v14.1.0` `v13.4.25` `v13.4.24` `v13.4.23` `v13.4.22` `v13.4.21` `v14.0.0` `v13.4.20` `v13.4.19` `v13.4.18` `v13.4.17` `v13.4.16` `v13.4.15` `v13.4.14` `v13.4.13` `v13.4.12` `v13.4.11` `v13.4.10` `v13.4.9` `v13.4.8` `v13.4.7` `v13.4.6` `v13.4.5` `v13.4.4` `v13.4.3` `v13.4.2` `v13.4.1` `v13.4.0` `v13.3.0` `v13.2.1` `v13.2.0` `v13.1.0` `v13.0.0`

Description

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

CVE-2026-49742

Affected versions

Repository

Description

References