GitHub Advisoryadvisory · Packagist

GHSA-54jj-pxx2-pv8h TYPO3 doesn't properly check file extensions

HIGH Published 2022-05-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2013-4250
Ecosystem
Packagist
Packages
typo3/cms
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-20, CWE-434
Reviewed
2025-04-14

Affected packages

• Packagist typo3/cms: >= 6.0.0, < 6.0.8 → fixed in 6.0.8 • Packagist typo3/cms: >= 6.1.0, < 6.1.3 → fixed in 6.1.3

Description

The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.

Related

Alias · CVE (1)

  • CVE-2013-4250 The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References