### Problem Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. ### Solution Update to TYPO3 versions 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it. ### Resources * [TYPO3-CORE-SA-2026-013](https://typo3.org/security/advisory/typo3-core-sa-2026-013)
Update typo3/cms-core to 11.5.51; typo3/cms-core to 12.4.46; typo3/cms-core to 13.4.31; typo3/cms-core to 14.3.3; typo3/cms-filelist to 11.5.51; typo3/cms-filelist to 12.4.46; typo3/cms-filelist to 13.4.31; typo3/cms-filelist to 14.3.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanTYPO3 CMS has Broken Access Control in its Media Module affects typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-filelist (composer), typo3/cms-filelist (composer), typo3/cms-filelist (composer), typo3/cms-filelist (composer). Severity is high. ### Problem Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. ### Solution Update to TYPO3 versions 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it. ### Resources * [TYPO3-CORE-SA-2026-013](https://typo3.org/security/advisory/typo3-core-sa-2026-013)
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
### Problem Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. ### Solution Update to TYPO3 versions 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it. ### Resources * [TYPO3-CORE-SA-2026-013](https://typo3.org/security/advisory/typo3-core-sa-2026-013)
Update typo3/cms-core to 11.5.51; typo3/cms-core to 12.4.46; typo3/cms-core to 13.4.31; typo3/cms-core to 14.3.3; typo3/cms-filelist to 11.5.51; typo3/cms-filelist to 12.4.46; typo3/cms-filelist to 13.4.31; typo3/cms-filelist to 14.3.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanTYPO3 CMS has Broken Access Control in its Media Module affects typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-filelist (composer), typo3/cms-filelist (composer), typo3/cms-filelist (composer), typo3/cms-filelist (composer). Severity is high. ### Problem Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files. ### Solution Update to TYPO3 versions 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it. ### Resources * [TYPO3-CORE-SA-2026-013](https://typo3.org/security/advisory/typo3-core-sa-2026-013)
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|
| typo3/cms-corecomposer | >=11.0.0,<11.5.51 | 11.5.51 |
|---|---|---|
| typo3/cms-corecomposer | >=12.0.0,<12.4.46 | 12.4.46 |
| typo3/cms-corecomposer | >=13.0.0,<13.4.31 | 13.4.31 |
| typo3/cms-corecomposer | >=14.0.0,<14.3.3 | 14.3.3 |
| typo3/cms-filelistcomposer | >=11.0.0,<11.5.51 | 11.5.51 |
| typo3/cms-filelistcomposer | >=12.0.0,<12.4.46 | 12.4.46 |
| typo3/cms-filelistcomposer | >=13.0.0,<13.4.31 | 13.4.31 |
| typo3/cms-filelistcomposer | >=14.0.0,<14.3.3 | 14.3.3 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| Package | Affected range | Fixed version |
|---|
| typo3/cms-corecomposer | >=11.0.0,<11.5.51 | 11.5.51 |
|---|---|---|
| typo3/cms-corecomposer | >=12.0.0,<12.4.46 | 12.4.46 |
| typo3/cms-corecomposer | >=13.0.0,<13.4.31 | 13.4.31 |
| typo3/cms-corecomposer | >=14.0.0,<14.3.3 | 14.3.3 |
| typo3/cms-filelistcomposer | >=11.0.0,<11.5.51 | 11.5.51 |
| typo3/cms-filelistcomposer | >=12.0.0,<12.4.46 | 12.4.46 |
| typo3/cms-filelistcomposer | >=13.0.0,<13.4.31 | 13.4.31 |
| typo3/cms-filelistcomposer | >=14.0.0,<14.3.3 | 14.3.3 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard