TYPO3 CMS has Broken Access Control in its File Abstraction Layer

🗓️ 12 Jun 2026 19:09:04Reported by GitHub Advisory DatabaseType

TYPO3 File Abstraction Layer path check flaw; update to affected versions.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-49738	10 Jun 202613:15	–	circl
CNNVD	TYPO3 CMS 路径遍历漏洞	9 Jun 202600:00	–	cnnvd
CVE	CVE-2026-49738	9 Jun 202610:53	–	cve
Cvelist	CVE-2026-49738 TYPO3 CMS - Broken Access Control in File Abstraction Layer	9 Jun 202610:53	–	cvelist
EUVD	EUVD-2026-35400	12 Jun 202619:09	–	euvd
Friends Of PHP	TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer	9 Jun 202609:01	–	friendsofphp
NVD	CVE-2026-49738	9 Jun 202611:16	–	nvd
OSV	GHSA-JF56-V8JC-JCC5 TYPO3 CMS has Broken Access Control in its File Abstraction Layer	12 Jun 202619:09	–	osv
Positive Technologies	PT-2026-47746	9 Jun 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-49738	10 Jun 202615:00	–	redhatcve

Vulners

Node

typo3 cms-coreRange14.0.0–14.3.3composer

typo3 cms-coreRange13.0.0–13.4.31composer

typo3 cms-coreRange12.0.0–12.4.46composer

typo3 cms-coreRange11.0.0–11.5.51composer

typo3 cms-coreRange<10.4.57composer

Source	Link
github	www.github.com/TYPO3/typo3/security/advisories/GHSA-jf56-v8jc-jcc5
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-49738
github	www.github.com/TYPO3/typo3/commit/150a983a5d687cedcfc33bbe9c335d9a13fd05e5
github	www.github.com/TYPO3/typo3/commit/44c2fa9807944136218a0842e3051c0a379a002d
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49738.yaml
typo3	www.typo3.org/security/advisory/typo3-core-sa-2026-016
github	www.github.com/advisories/GHSA-jf56-v8jc-jcc5

12 Jun 2026 19:09Current

5.2Medium risk

Vulners AI Score5.2

CVSS 42.1

EPSS0.00356

SSVC