Vulnerability advisory
GHSA-54jj-pxx2-pv8h
TYPO3 doesn't properly check file extensions
Also known as CVE-2013-4250
Severity
- CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected versions
typo3/cms Packagist
All typo3/cms advisories →| Affected | Fixed in |
|---|---|
6.0.0 to before 6.0.8 | 6.0.8Advisories → |
6.1.0 to before 6.1.3 | 6.1.3Advisories → |
Description
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.