CVE-2026-49133: Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()

Synopsis

A path traversal vulnerability in Typemill before 2.24.0 allows authenticated attackers holding Author-level privileges to read arbitrary files outside the intended content directory by injecting traversal sequences into the path query parameter of the ControllerApiImage::getPagemedia() endpoint. The flaw is reachable over the network and bypasses the traversal-prevention logic in Storage::getFolderPath() when the folder argument is empty. Successful exploitation gives an attacker read access to sensitive files on the server, such as configuration files containing credentials or private application data. A patched-image rebuild at version 2.24.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the Typemill service via HTTP/HTTPS.

• AuthenticationRequired

  Any valid Author-level account is sufficient; no administrator or elevated privilege is needed beyond that low-privilege role.

• Victim interactionNot required

  No action from another user or administrator is needed; the attacker sends the malicious request directly.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors are required to trigger the traversal.

Blast Radius

• Reads arbitrary files on the server filesystem outside the intended content directory, including configuration files that may contain database credentials, API keys, or secret tokens.
• Reads system files such as /etc/passwd or application environment files that reveal internal infrastructure details useful for further attacks.
• Confidentiality of all file-system content accessible to the Typemill process is compromised; integrity and availability are not directly affected by this vulnerability.