PT-2026-118306 · Typo3 · Extension "Fal Protect"
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
Fix
Missing Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Extension "Fal Protect"