Live › vulnerability › CVE-2026-112069
Go to dashboardThe extension stopped applying its access checks to files in file storages that use a non-default relative base path, so those files were served directly by the web server. An anonymous visitor who knows or guesses a file path can download files that should be restricted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running this TYPO3 extension on TYPO3 14.3 that serve protected files from a file storage with a non-default relative base path. Sites on other TYPO3 versions, or that keep the default base path, are not described as exposed.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
This page as .md · .json · in your agent: get_signal("CVE-2026-112069")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.