-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms | composer | >= 8.0.0, < 8.7.23 | 8.7.23 |
| typo3/cms | composer | >= 9.0.0, < 9.5.4 | 9.5.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from an incomplete file deny pattern in TYPO3's configuration. The SystemEnvironmentBuilder::defineBaseConstants() method is directly responsible for setting the FILE_DENY_PATTERN_DEFAULT constant, which governs restricted file types. The commit patching this vulnerability explicitly modifies this function to add the missing extensions. Since this function controls the security-critical deny pattern configuration, its outdated implementation in vulnerable versions is the root cause enabling unsafe file uploads.
Ongoing coverage of React2Shell