GitHub Advisoryadvisory · Packagist

GHSA-m76j-69c2-c3m8 TYPO3 vulnerable to remote authenticated arbitrary code execution

HIGH Published 2022-05-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2013-4321
Ecosystem
Packagist
Packages
typo3/cms
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weaknesses
CWE-94
Reviewed
2025-04-14

Affected packages

• Packagist typo3/cms: >= 6.0.0, < 6.0.9 → fixed in 6.0.9 • Packagist typo3/cms: >= 6.1.0, < 6.1.4 → fixed in 6.1.4

Description

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.

Related

Alias · CVE (1)

  • CVE-2013-4321 The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References