Path Traversal in Typo3 Cms

CVE-2026-49742

Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root…

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.003 (23.6th percentile) — read the EPSS interpretation.