What is GHSA-54jj-pxx2-pv8h?

GHSA-54jj-pxx2-pv8h is a security advisory published by GitHub Security Advisories with High severity. TYPO3 doesn't properly check file extensions

Which CVE IDs does GHSA-54jj-pxx2-pv8h cover?

GHSA-54jj-pxx2-pv8h covers the following CVE IDs: CVE-2013-4250. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-54jj-pxx2-pv8h?

GHSA-54jj-pxx2-pv8h affects 2 products, including: composer/typo3/cms:\u003e= 6.0.0, \u003c 6.0.8; composer/typo3/cms:\u003e= 6.1.0, \u003c 6.1.3.

GHSA-54jj-pxx2-pv8hHigh

TYPO3 doesn't properly check file extensions

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

April 14, 2025

🔗 CVE IDs covered (1)

CVE-2013-4250 →

📋 Description

The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.

🎯 Affected products2

composer/typo3/cms:>= 6.0.0, < 6.0.8
composer/typo3/cms:>= 6.1.0, < 6.1.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2013-4250
https://typo3.org/security/advisory/typo3-core-sa-2013-002
https://github.com/advisories/GHSA-54jj-pxx2-pv8h