UpHeron
All vulnerabilities

Servers and applications

CVE-2023-30451

Path Traversal in TYPO3 File Abstraction Layer Storages

Severity
Medium 4.9
Published
25 Dec 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Also known as
GHSA-w6x2-jg8h-p6mp
Sources
NVD, Project advisories (GitHub)

Description

In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].

Affected software

SoftwareAffected versions
TYPO3Servers and applications · cpe:a:typo3:typo3
  • Version 11.5.24
TYPO3Servers and applications · github:typo3/typo3
  • Version 13.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-30451
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-30451
  • GitHub Advisory Database https://github.com/advisories/GHSA-w6x2-jg8h-p6mp
  • github.com https://github.com/TYPO3/typo3/security/advisories/GHSA-w6x2-jg8h-p6mp