What is GHSA-m76j-69c2-c3m8?

GHSA-m76j-69c2-c3m8 is a security advisory published by GitHub Security Advisories with High severity. TYPO3 vulnerable to remote authenticated arbitrary code execution

Which CVE IDs does GHSA-m76j-69c2-c3m8 cover?

GHSA-m76j-69c2-c3m8 covers the following CVE IDs: CVE-2013-4321. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-m76j-69c2-c3m8?

GHSA-m76j-69c2-c3m8 affects 2 products, including: composer/typo3/cms:\u003e= 6.0.0, \u003c 6.0.9; composer/typo3/cms:\u003e= 6.1.0, \u003c 6.1.4.

GHSA-m76j-69c2-c3m8High

TYPO3 vulnerable to remote authenticated arbitrary code execution

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

April 14, 2025

🔗 CVE IDs covered (1)

CVE-2013-4321 →

📋 Description

The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4250.

🎯 Affected products2

composer/typo3/cms:>= 6.0.0, < 6.0.9
composer/typo3/cms:>= 6.1.0, < 6.1.4

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2013-4321
https://typo3.org/security/advisory/typo3-core-sa-2013-003
https://github.com/advisories/GHSA-m76j-69c2-c3m8