The path allowance check in GeneralUtility::isAllowedAbsPath() used a plain string prefix comparison, missing a directory separator boundary. This allowed a path such as /var/www/html‑other/secret.yaml to be treated as within the project root when the root was /var/www/html. Administrators who could use the File Abstraction Layer could therefore create file storage definitions that pointed to directories outside the intended project scope, bypassing the path validation. The consequence is that privileged users could read or modify files outside the web‑root, potentially exposing sensitive configuration data or compromising the integrity of the application.

TYPO3 CMS, versions before 10.4.57, 11.0.0–11.5.51, 12.0.0–12.4.46, 13.0.0–13.4.31, and 14.0.0–14.3.3 are vulnerable.

The CVSS score of 2.1 indicates a low severity from a technical perspective. Because the vulnerability is only exploitable by users who already have administrative access to the File Abstraction Layer, the risk is limited to environments where an attacker can compromise an administrator account. EPSS data is not available and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. Nevertheless, the bug allows an attacker with the required privileges to access or alter files outside the designated project root.