Description
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for Apache, which allows remote attackers to bypass security restrictions and upload configuration files such as .htaccess, or conduct file upload attacks using multiple extensions.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 4.0 | typo3-src | 4.0.2+debian-5 | DSA-1596-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | typo3/cms-core | >= 4.0.0, < 4.0.9 | 4.0.9 | GHSA-f35p-hcwf-9f9f |
| Packagist | typo3/cms-core | >= 4.1.0, < 4.1.7 | 4.1.7 | GHSA-f35p-hcwf-9f9f |
| Packagist | typo3/cms-core | >= 4.2.0, < 4.2.1 | 4.2.1 | GHSA-f35p-hcwf-9f9f |
Advisories 1
- DSA-1596-1 typo3-src - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- 29657 vdb-entry
- http://buzz.typo3.org/teams/security/article/advice-on-core-security-issue-regarding-filedenypattern/
- 30619 third-party-advisory
- 20080611 TYPO3 Security Bulletin TYPO3-20080611-1: Multiple vulnerabilities in TYPO3 Core mailing-list
- typo3-filename-file-upload(42988) vdb-entry
- DSA-1596 vendor-advisory
- ADV-2008-1802 vdb-entry
- 30660 third-party-advisory
- http://typo3.org/teams/security/security-bulletins/typo3-20080611-1/
- 3945 third-party-advisory