CVE-2026-49742: TYPO3 CMS - Broken Access Control in Media Module

Vulnerability summary

CVE-2026-49742 is a high (CVSS 7.1) vulnerability in typo3 typo3 cms. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 24.2% of scored vulnerabilities.

Timeline

1. 09-06-2026
   PublishedVulnerability first disclosed.
2. 11-06-2026
   Last modifiedVulnerability information updated.

Description

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. This issue affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

• CWE-22Improper Limitation of a Pathname to a Restricted DirectoryThe product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.