Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 11.0.0, < 11.5.51 | 11.5.51 |
| typo3/cms-core | composer | >= 12.0.0, < 12.4.46 | 12.4.46 |
| typo3/cms-core | composer | >= 13.0.0, < 13.4.31 | 13.4.31 |
| typo3/cms-core | composer | >= 14.0.0, < 14.3.3 | 14.3.3 |
| typo3/cms-filelist | composer | >= 11.0.0, < 11.5.51 | 11.5.51 |
| typo3/cms-filelist | composer | >= 12.0.0, < 12.4.46 | 12.4.46 |
| typo3/cms-filelist | composer | >= 13.0.0, < 13.4.31 | 13.4.31 |
| typo3/cms-filelist | composer | >= 14.0.0, < 14.3.3 | 14.3.3 |
Miggo AIRoot Cause AnalysisThe vulnerability exists in the FileDownloadController of the TYPO3 CMS file list extension. Backend users with file download permissions could download files from the fallback storage of the File Abstraction Layer (FAL). The fallback storage resolves paths relative to the server's document root, which could expose sensitive files like log files.
The patch addresses this by modifying the collectFiles method within the TYPO3\CMS\Filelist\Controller\FileDownloadController class. A check is added to determine if a file belongs to a fallback storage using $fileOrFolderObject->getStorage()->isFallbackStorage(). If it does, the file is skipped, preventing its inclusion in the download archive.
The primary entry point for this functionality is the handleRequest method in the same controller, which processes the download request and calls collectFiles. Therefore, both handleRequest and collectFiles are relevant to this vulnerability. handleRequest is the function that would likely appear in a runtime profile during exploitation, as it's the public method handling the request. The actual vulnerability logic is within the collectFiles method.
TYPO3\CMS\Filelist\Controller\FileDownloadController::handleRequesttypo3/sysext/filelist/Classes/Controller/FileDownloadController.php
TYPO3\CMS\Filelist\Controller\FileDownloadController::collectFilestypo3/sysext/filelist/Classes/Controller/FileDownloadController.php