GHSA-54jj-pxx2-pv8h
Suggest an improvement- Source
- https://github.com/advisories/GHSA-54jj-pxx2-pv8h
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-54jj-pxx2-pv8h/GHSA-54jj-pxx2-pv8h.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-54jj-pxx2-pv8h
- Aliases
-
- CVE-2013-4250
- Published
- 2022-05-17T04:43:06Z
- Modified
- 2025-04-14T16:27:09Z
- Severity
-
- 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- TYPO3 doesn't properly check file extensions
- Details
-
The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.
- Database specific
{ "cwe_ids": [ "CWE-20", "CWE-434" ], "github_reviewed": true, "github_reviewed_at": "2025-04-14T15:47:43Z", "nvd_published_at": "2014-05-20T14:55:00Z", "severity": "HIGH" }- References