HIGH

GHSA-54jj-pxx2-pv8h

TYPO3 doesn't properly check file extensions

Quick fix

GHSA-54jj-pxx2-pv8h — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^6.0.8

Details

The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/typo3/cms

Introduced in: 6.0.0Fixed in: 6.0.8

Fixcomposer require typo3/cms:^6.0.8

Packagist/typo3/cms

Introduced in: 6.1.0Fixed in: 6.1.3

Fixcomposer require typo3/cms:^6.1.3

References

https://nvd.nist.gov/vuln/detail/CVE-2013-4250[ADVISORY]
https://github.com/TYPO3/typo3[PACKAGE]
https://typo3.org/security/advisory/typo3-core-sa-2013-002[WEB]