CVE-2026-49742

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-49742
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49742.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-49742
Aliases
Published
2026-06-09T10:54:58.139Z
Modified
2026-07-08T07:34:21.553467421Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
TYPO3 CMS - Broken Access Control in Media Module
Details

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "introduced": "11.0.0"
                },
                {
                    "fixed": "11.5.51"
                },
                {
                    "introduced": "12.0.0"
                },
                {
                    "fixed": "12.4.46"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49742.json",
    "cna_assigner": "TYPO3",
    "cwe_ids": [
        "CWE-200",
        "CWE-22"
    ]
}
References

Affected packages

Git / github.com/typo3/typo3

Affected ranges

Type
GIT
Repo
https://github.com/typo3/typo3
Events
Introduced
fd8745e46bb11773e85524b8ee9650dabe340713
Introduced
6d6bd23afff6a48ee3efeaa68eb829820397d6a1
Fixed
59bfeaaf0136dfe17011786ce825884e48bedc8d
Fixed
e16ec78165a7d60f09dcac04bfbb309409e174b3
Fixed
ad636b6183843b57c758a1e12174a75093ac93c3
Fixed
caa6b444d7ab1bdd1eb76a68004c8be73d98e6ae
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "13.0.0"
        },
        {
            "fixed": "13.4.31"
        },
        {
            "introduced": "14.0.0"
        },
        {
            "fixed": "14.3.3"
        }
    ]
}

Affected versions

v13.*
v13.0.0
v13.1.0
v13.2.0
v13.2.1
v13.3.0
v13.4.0
v13.4.1
v13.4.10
v13.4.11
v13.4.12
v13.4.13
v13.4.14
v13.4.15
v13.4.16
v13.4.17
v13.4.18
v13.4.19
v13.4.2
v13.4.20
v13.4.21
v13.4.22
v13.4.23
v13.4.24
v13.4.25
v13.4.26
v13.4.27
v13.4.28
v13.4.29
v13.4.3
v13.4.30
v13.4.4
v13.4.5
v13.4.6
v13.4.7
v13.4.8
v13.4.9
v14.*
v14.0.0
v14.1.0
v14.2.0
v14.3.0
v14.3.1
v14.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-49742.json"