Security Digest · Critical advisory (no CVE assigned)
GHSA-67wg-6j7r-mqh8: Arbitrary Code Execution in TYPO3 CMS
Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload .pht files which can be executed in certain web server setups.
CVSS 9.9 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | typo3/cms | >= 7.6.0, < 7.6.22 | 7.6.22 |
| Composer (PHP) | typo3/cms | >= 8.0.0, < 8.7.5 | 8.7.5 |
Details
Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload .pht files which can be executed in certain web server setups. The new default fileDenyPattern is the following, which might have been overridden in the TYPO3 Install Tool.
CVSS: 9.9 (v3.1) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-67wg-6j7r-mqh8 github.com
- github.com github.com
- typo3.org typo3.org
Critical Composer (PHP) advisories · Today’s Security Digest