CVE-2026-49742: TYPO3 CMS - Broken Access Control in Media Module

Synopsis

Broken access control in the TYPO3 CMS Media Module allows authenticated backend users to read files outside their intended scope. The vulnerability is reachable over the network and requires only a low-privilege account with file download permissions. Successful exploitation lets an attacker download arbitrary files relative to the server's document root, including sensitive files such as application logs. Patched-image rebuilds at versions 11.5.51, 12.4.46, 13.4.31, and 14.3.3 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The TYPO3 backend Media Module is exposed over the network, so an attacker must be able to reach the application's HTTP interface to trigger the download.

• AuthenticationRequired

  A low-privilege backend account with file download permissions is sufficient; no administrative role is needed.

• Victim interactionNot required

  The attacker can send the malicious file download request directly with no action required from any other user.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions or special environmental factors need to align.

Blast Radius

• Reads arbitrary files relative to the server's document root via the FAL fallback storage, including application log files that may contain session tokens, stack traces, or internal path information.
• Reads configuration-adjacent files (such as .env or settings files) if they reside within the document root traversal scope, potentially exposing database credentials or API keys.
• Exposes user-activity and error logs that can be used to map internal application behavior and enumerate other attack surfaces.