Nikita Hovratov

An authenticated backend user with access to the Mask module can perform path traversal, a technique used to access files and directories that are restricted from the user. The extension fails to validate a client-supplied template element key used to build file paths for saving and deleting Mask template files. By supplying a key containing path traversal sequences, an attacker can create or delete .html files outside the configured template directory.

An issue was discovered in the jobfair extension for TYPO3, where the extension fails to protect or obfuscate filenames of uploaded files. This allows unauthenticated users to download files with sensitive data by simply guessing the filename of uploaded files, for example, `uploads/tx jobfair/cv.pdf`.