GHSA-r287-hc8j-w56h
TYPO3 Information Disclosure Vulnerability Exploitable by Editors
GHSA-r287-hc8j-w56h is a medium vulnerability (CVSS 6.5) in typo3/cms, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms 6.2.14.
- Severity
- 6.5 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
6.2.14typo3/cms +3 more
Description
It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account is needed to exploit this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist | 6.2.0 up to 6.2.14 | 6.2.14 |
typo3/cmsPackagist | 7.0.0 up to 7.3.1 | 7.3.1 |
typo3/cmsPackagist | 6.2.0 up to 6.2.14, plus listed versions 6.2.16.2.106.2.10-rc16.2.116.2.12 Show 9 moreShow less6.2.136.2.26.2.36.2.46.2.56.2.66.2.76.2.86.2.9 | 6.2.14 |
typo3/cmsPackagist | 7.0.0 up to 7.3.1, plus listed versions 7.0.17.0.27.1.07.2.07.3.0 | 7.3.1 |
What each source reports
GitHub Advisories Score used
TYPO3 Information Disclosure Vulnerability Exploitable by Editors
It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account is needed to exploit this vulnerability.
- Record
GHSA-r287-hc8j-w56h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
OSV
TYPO3 Information Disclosure Vulnerability Exploitable by Editors
It has been discovered, that editors with access to the file list module could list all files names and folder names in the root directory of a TYPO3 installation. Modification of files, listing further nested directories or retrieving file contents was not possible. A valid backend user account is needed to exploit this vulnerability.
- Record
GHSA-r287-hc8j-w56h- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/TYPO3/typo3/commit/d9caccb26c954834e7d43fbbe84a3130cc95524a
typo3.org/security/advisory/typo3-core-sa-2015-005