CRITICAL9.9

GHSA-67wg-6j7r-mqh8

Arbitrary Code Execution in TYPO3 CMS

Quick fix

GHSA-67wg-6j7r-mqh8 — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^7.6.22

Details

Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload *.pht files which can be executed in certain web server setups. The new default fileDenyPattern is the following, which might have been overridden in the TYPO3 Install Tool. ``` \.(php[3-7]?|phpsh|phtml|pht)(\..*)?$|^\.htaccess$ ```

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/typo3/cms

Introduced in: 7.6.0Fixed in: 7.6.22

Fixcomposer require typo3/cms:^7.6.22

Packagist/typo3/cms

Introduced in: 8.0.0Fixed in: 8.7.5

Fixcomposer require typo3/cms:^8.7.5

References

https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2017-09-05-4.yaml[WEB]
https://github.com/TYPO3/typo3[PACKAGE]
https://typo3.org/security/advisory/typo3-core-sa-2017-007[WEB]