GHSA-4r76-xr68-w7m7
TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
GHSA-4r76-xr68-w7m7 is a high vulnerability (CVSS 8.8) in typo3/cms, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms 6.2.14.
- Severity
- 8.8 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.2.14typo3/cms +3 more
Description
It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 6.2.0 up to 6.2.14 | 6.2.14 |
typo3/cmsPackagist | 7.0.0 up to 7.3.1 | 7.3.1 |
typo3/cmsPackagist | 6.2.0 up to 6.2.14, plus listed versions 6.2.16.2.106.2.10-rc16.2.116.2.12 Show 9 moreShow less6.2.136.2.26.2.36.2.46.2.56.2.66.2.76.2.86.2.9 | 6.2.14 |
typo3/cmsPackagist | 7.0.0 up to 7.3.1, plus listed versions 7.0.17.0.27.1.07.2.07.3.0 | 7.3.1 |
What each source reports
GitHub Advisories Score used
TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
- Record
GHSA-4r76-xr68-w7m7- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
OSV
TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
It has been discovered, that editors with access to file meta data table could change, create or delete metadata of files which are not within their file mounts.
- Record
GHSA-4r76-xr68-w7m7- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/TYPO3/typo3/commit/0decbf83c531cab77497429eb2edecf9a1038b25
typo3.org/security/advisory/typo3-core-sa-2015-002