Path Traversal in Typo3 Cms

CVE-2026-49738

The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as v…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.004 (28.2th percentile) — read the EPSS interpretation.