---
id: CVE-2026-49742
aliases:
  - GHSA-chm7-4vch-h8vr
title: TYPO3 CMS has Broken Access Control in its Media Module
summary: TYPO3 CMS has Broken Access Control in its Media Module
severity: high
cwe:
  - CWE-22
  - CWE-200
vendor: typo3
product: typo3/cms-core
ecosystem: composer
affected:
  - 'typo3/cms-core >= 11.0.0, < 11.5.51'
  - 'typo3/cms-core >= 12.0.0, < 12.4.46'
  - 'typo3/cms-core >= 13.0.0, < 13.4.31'
  - 'typo3/cms-core >= 14.0.0, < 14.3.3'
  - 'typo3/cms-filelist >= 11.0.0, < 11.5.51'
  - 'typo3/cms-filelist >= 12.0.0, < 12.4.46'
  - 'typo3/cms-filelist >= 13.0.0, < 13.4.31'
  - 'typo3/cms-filelist >= 14.0.0, < 14.3.3'
patched:
  - typo3/cms-core 11.5.51
  - typo3/cms-core 12.4.46
  - typo3/cms-core 13.4.31
  - typo3/cms-core 14.3.3
  - typo3/cms-filelist 11.5.51
  - typo3/cms-filelist 12.4.46
  - typo3/cms-filelist 13.4.31
  - typo3/cms-filelist 14.3.3
published: '2026-06-12'
updated: '2026-06-12'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-chm7-4vch-h8vr'
references:
  - url: 'https://github.com/TYPO3/typo3/security/advisories/GHSA-chm7-4vch-h8vr'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49742'
  - url: >-
      https://github.com/TYPO3/typo3/commit/ad636b6183843b57c758a1e12174a75093ac93c3
  - url: >-
      https://github.com/TYPO3/typo3/commit/caa6b444d7ab1bdd1eb76a68004c8be73d98e6ae
  - url: >-
      https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49742.yaml
  - url: 'https://typo3.org/security/advisory/typo3-core-sa-2026-013'
  - url: 'https://github.com/advisories/GHSA-chm7-4vch-h8vr'
tags:
  - ghsa
  - composer
epss: 0.00459
epssPercentile: 0.37123
ingestedAt: '2026-07-07T15:41:59.027Z'
---

## Overview

### Problem
Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. Since the fallback storage resolves paths relative to the server's document root, this could expose sensitive files such as log files.

### Solution
Update to TYPO3 versions 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described.

### Credits
TYPO3 CMS thanks Hyunseo Shin for reporting this issue, and to TYPO3 security team member Torben Hansen for fixing it.

### Resources
* [TYPO3-CORE-SA-2026-013](https://typo3.org/security/advisory/typo3-core-sa-2026-013)

## Affected packages

- `typo3/cms-core >= 11.0.0, < 11.5.51`
- `typo3/cms-core >= 12.0.0, < 12.4.46`
- `typo3/cms-core >= 13.0.0, < 13.4.31`
- `typo3/cms-core >= 14.0.0, < 14.3.3`
- `typo3/cms-filelist >= 11.0.0, < 11.5.51`
- `typo3/cms-filelist >= 12.0.0, < 12.4.46`
- `typo3/cms-filelist >= 13.0.0, < 13.4.31`
- `typo3/cms-filelist >= 14.0.0, < 14.3.3`

## Remediation

Upgrade to a patched release:

- `typo3/cms-core 11.5.51`
- `typo3/cms-core 12.4.46`
- `typo3/cms-core 13.4.31`
- `typo3/cms-core 14.3.3`
- `typo3/cms-filelist 11.5.51`
- `typo3/cms-filelist 12.4.46`
- `typo3/cms-filelist 13.4.31`
- `typo3/cms-filelist 14.3.3`