Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | < 10.4.57 | 10.4.57 |
| typo3/cms-core | composer | >= 11.0.0, < 11.5.51 | 11.5.51 |
| typo3/cms-core | composer | >= 12.0.0, < 12.4.46 | 12.4.46 |
| typo3/cms-core | composer | >= 13.0.0, < 13.4.31 | 13.4.31 |
| typo3/cms-core | composer | >= 14.0.0, < 14.3.3 | 14.3.3 |
Miggo AIRoot Cause AnalysisThe analysis of the provided security patches clearly indicates that the vulnerability is located in the isAllowedAbsPath function within the GeneralUtility.php file of the TYPO3 core. The diffs in commits 150a983a5d687cedcfc33bbe9c335d9a13fd05e5 and 44c2fa9807944136218a0842e3051c0a379a002d show the exact change that mitigates the vulnerability. The original code used a simple str_starts_with check to validate if a given path was within the project's allowed directories. However, this check did not enforce a directory boundary, making it possible to bypass the restriction. For instance, if the project path was /var/www/html, a path like /var/www/html-secret would be incorrectly allowed. The fix involves appending a / to the project and public paths before the str_starts_with comparison. This ensures that the check correctly identifies and restricts access to only those paths that are legitimate subdirectories of the project root, thus resolving the path traversal vulnerability.
TYPO3\CMS\Core\Utility\GeneralUtility::isAllowedAbsPathtypo3/sysext/core/Classes/Utility/GeneralUtility.php