GitHub Advisoryadvisory · Packagist

GHSA-rmqc-wfjm-3f66 TYPO3 Directory Traversal vulnerability

MEDIUM Published 2022-05-17 Modified 2025-04-12 Official page ↗
Aliases
CVE-2010-5101
Ecosystem
Packagist
Packages
typo3/cms
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-22
Reviewed
2025-04-12

Affected packages

• Packagist typo3/cms: >= 4.2.0, < 4.2.16 → fixed in 4.2.16 • Packagist typo3/cms: >= 4.3.0, < 4.3.9 → fixed in 4.3.9 • Packagist typo3/cms: >= 4.4.0, < 4.4.5 → fixed in 4.4.5

Description

Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated administrators to read arbitrary files via unspecified vectors related to the "file inclusion functionality."

Related

Alias · CVE (1)

  • CVE-2010-5101 Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References