Typo3 Extension "FAL Protect" vulnerabilities

1 vulnerability

Known vulnerabilities in Typo3 Extension "FAL Protect", newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

RoutineCVE-2026-112069typo3 · extension "fal protect"Broken Access Control in extension "FAL Protect" (fal_protect)The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.CVSS6.3MediumEPSS0.47%