CVE-2019-19848
TYPO3 Directory Traversal on ZIP extraction
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
- Record
CVE-2019-19848- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:R - Updated
- 2026-11-02
EUVDEUVD-2022-2945
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
- Record
EUVD-2022-2945- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:H/S:U/UI:R - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-77p4-wfr8-977w
TYPO3 Directory Traversal on ZIP extraction
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
- Record
GHSA-77p4-wfr8-977w- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
NVD
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
- Record
CVE-2019-19848- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-22
- Updated
- 2026-11-02
OSV
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
- Record
CVE-2019-19848- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-77p4-wfr8-977w
TYPO3 Directory Traversal on ZIP extraction
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP archives in Extension Manager is vulnerable to directory traversal. Admin privileges are required in order to exploit this vulnerability. (In v9 LTS and later, System Maintainer privileges are also required.)
- Record
GHSA-77p4-wfr8-977w- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-22
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cms-corePackagist |
10.0.0 up to 10.2.2 | 10.2.2 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.30 | 8.7.30 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.12 | 9.5.12 |
typo3/cmsPackagist |
10.0.0 up to 10.2.2 | 10.2.2 |
typo3/cmsPackagist |
8.0.0 up to 8.7.30 | 8.7.30 |
typo3/cmsPackagist |
9.0.0 up to 9.5.12 | 9.5.12 |
typo3/cms-corePackagist |
10.0.0 up to 10.2.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1 |
10.2.2 |
typo3/cms-corePackagist |
8.0.0 up to 8.7.30, plus listed versions v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14 Show 18 moreShow lessv8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.7v8.7.8v8.7.9 |
8.7.30 |
typo3/cms-corePackagist |
9.0.0 up to 9.5.12, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 16 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.12 |
typo3/cmsPackagist |
10.0.0 up to 10.2.2, plus listed versions v10.0.0v10.1.0v10.2.0v10.2.1 |
10.2.2 |
typo3/cmsPackagist |
8.0.0 up to 8.7.30, plus listed versions 8.0.18.1.08.1.18.1.28.2.0 Show 39 moreShow less8.2.18.3.08.3.18.4.08.4.18.5.08.5.18.6.08.6.18.7.08.7.18.7.2v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.23v8.7.24v8.7.25v8.7.26v8.7.27v8.7.28v8.7.29v8.7.3v8.7.4v8.7.5v8.7.6v8.7.7v8.7.8v8.7.9 |
8.7.30 |
typo3/cmsPackagist |
9.0.0 up to 9.5.12, plus listed versions v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0 Show 16 moreShow lessv9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.10v9.5.11v9.5.2v9.5.3v9.5.4v9.5.5v9.5.6v9.5.7v9.5.8v9.5.9 |
9.5.12 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-19848 is a medium vulnerability (CVSS 6.8) in Typo3, published December 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in typo3/cms-core 10.2.2.
References
typo3.org/security/advisory/typo3-core-sa-2019-024
review.typo3.org/q/%2522Resolves:+%252388764%2522+topic:security
nvd.nist.gov/vuln/detail/CVE-2019-19848
github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2019-19848.yaml