The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory separator boundary, causing a path such as /var/www/html‑other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator users with access to the File Abstraction Layer could create new file storage definitions pointing to directories outside the project root, bypassing this path check. This flaw allows privileged users to read or modify files beyond the intended web‑root, potentially exposing sensitive configuration data or compromising application integrity.

TYPO3 CMS versions before 10.4.57, 11.0.0–11.5.50, 12.0.0–12.4.45, 13.0.0–13.4.30, and 14.0.0–14.3.2 are vulnerable.

The CVSS score of 2.1 indicates a low severity from a technical perspective. Because the vulnerability is only exploitable by users who already have administrative access to the File Abstraction Layer, the risk is limited to environments where an attacker can compromise an administrator account. The EPSS score is less than 1% and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. Nevertheless, the bug permits an attacker with the required privileges to access or alter files outside the designated project root.