CVE-2026-49133

Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()

Published Jun 17, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile() with an empty folder argument. Attackers can bypass traversal-prevention controls in Storage::getFolderPath() to access sensitive files.

Analysis

Technical impact

Typemill versions prior to 2.24.0 contain a path traversal flaw that lets an authenticated user with Author privileges read any file outside the content directory. The weakness is a file‑system access control bypass (CWE‑22) triggered by traversal sequences in the path query used by Storage::getFile() when no folder argument is supplied. This permits disclosure of credential files, configuration files, or other sensitive data that resides outside the intended directory.

Affected Systems

The vulnerability affects the Typemill content‑management system, specifically all installations of typemill:typemill running a version earlier than 2.24.0. The correct level of remediation is to upgrade to version 2.24.0 or later.

Risk and Exploitability

The CVSS score of 7.1 indicates a high impact on confidentiality for authenticated attackers. The EPSS score is reported as less than 1%, showing a very low probability of observed exploitation at this time, and the issue is not listed in the CISA KEV catalog. Attackers need Author‑level access and to supply a crafted path parameter; once the path is provided, the application bypasses its usual folder‑path validation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

typemill

affected

Version	Status	Constraints
`0`	affected	< 2.24.0

No data.

Vendor Product Versions

Typemill

Version	Status	Scheme	Platform
`[0,2.24.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to typemill v2.24.0 or later to eliminate the path traversal bug
Restrict Author privileges to only those users that truly require content creation rights
Monitor application logs for unexpected requests containing traversal sequences or abnormal file‑access patterns

Generated by OpenCVE AI on June 18, 2026 at 19:57 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.343% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/typemill/typemill/commit/bfbb27001acd5c56ad62166dbefe6a59798cf1c0
https://github.com/typemill/typemill/releases/tag/v2.24.2
https://www.vulncheck.com/advisories/typemill-path-traversal-via-controllerapiimage-getpagemedia

History

Jul 14, 2026 9:45 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:typemill:typemill::::::::

Jun 18, 2026 7:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Typemill Typemill typemill
Vendors & Products		Typemill Typemill typemill

Jun 18, 2026 4:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 18, 2026 4:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile() with an empty folder argument. Attackers can bypass traversal-prevention controls in Storage::getFolderPath() to access sensitive files.
Title		Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()
Weaknesses		CWE-22
References		https://github.com/typemill/typemill/commit/bfbb27001acd5c56ad62166dbefe6a59798cf1c0 https://github.com/typemill/typemill/releases/tag/v2.24.2 https://www.vulncheck.com/advisories/typemill-path-traversal-via-controllerapiimage-getpagemedia
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`