TYPO3 Path Traversal vulnerability
Published 17 May 2022 · Updated 12 Apr 2025
Affected packages
- Affected
- >=4.2.0 <4.2.16
- Fixed in
- 4.2.16
composer require typo3/cms:^4.2.16- Affected
- >=4.3.0 <4.3.9
- Fixed in
- 4.3.9
composer require typo3/cms:^4.3.9- Affected
- >=4.4.0 <4.4.5
- Fixed in
- 4.4.5
composer require typo3/cms:^4.4.5Details
The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php.
Is GHSA-66j3-66cp-6c2m in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected typo3/cms, and gives you the command that fixes it.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2010-5099
- Linkexchange.xforce.ibmcloud.com/vulnerabilities/64180
- Packagegithub.com/TYPO3/typo3
- Linkweb.archive.org/web/20120801235059/http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022
- Linkblog.nibblesec.org/2010/12/typo3-sa-2010-020-typo3-sa-2010-022.html
- Linkwww.exploit-db.com/exploits/15856
- Linkwww.openwall.com/lists/oss-security/2011/01/13/2
- Linkwww.openwall.com/lists/oss-security/2012/05/10/7
- Linkwww.openwall.com/lists/oss-security/2012/05/11/3
- Linkwww.openwall.com/lists/oss-security/2012/05/12/5
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.