MEDIUM6.5

GHSA-9vxq-mxw5-mcgp

Typo3 Arbitrary File Delete

Quick fix

GHSA-9vxq-mxw5-mcgp — typo3/cms: upgrade to the fixed version with the command below.

composer require typo3/cms:^4.3.12

Details

TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.

Enter the version of the package you're using.

Introduced in: 0Fixed in: 4.3.12

Fixcomposer require typo3/cms:^4.3.12

Introduced in: 4.4.0Fixed in: 4.4.9

Fixcomposer require typo3/cms:^4.4.9

Introduced in: 4.5.0Fixed in: 4.5.4

Fixcomposer require typo3/cms:^4.5.4