The vulnerability in the TYPO3 extension "FAL Protect" removes the protection layer for files stored in file systems that use a non-default relative base path. As a result, these files are served directly by the web server without any authentication or permission checks. This flaw allows an unauthenticated attacker to read the contents of any file located in the affected file storage, potentially exposing sensitive information such as configuration files, user uploads, or other confidential data. The weakness is a classic instance of broken access control, designated CWE‑862.

TYPO3 sites that employ the "FAL Protect" extension and operate on TYPO3 version 14.3. The issue arises only when the extension is installed on a website running this specific TYPO3 release; earlier or later releases are not affected by this flaw.

The CVSS score of 6.3 indicates a moderate severity, and the EPSS value of less than 1% suggests a low likelihood of current exploitation. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread exploitation. Attackers would need to target a site whose file storage uses a non-default relative base path; they could then access files via a direct HTTP request to the web server, bypassing TYPO3’s authorization checks. Since the flaw is only exploitable under the stated conditions, the attack vector is largely constrained to sites with that exact configuration.