GHSA-fh4q-hxrw-cjqqHighCVSS 8.8

TYPO3 Arbitrary Code Execution

Published
May 17, 2022
Last Modified
April 25, 2024

🔗 CVE IDs covered (1)

CVE-2017-14251 →

📋 Description

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.

🎯 Affected products2

  • composer/typo3/cms:>= 7.6.0, < 7.6.22
  • composer/typo3/cms:>= 8.0.0, < 8.7.5

🔗 References (6)