The path allowance check in GeneralUtility::isAllowedAbsPath() performs a plain string prefix comparison without requiring a directory separator boundary. This flaw causes a path such as /var/www/html‑other/secret.yaml to be incorrectly accepted as valid when the project root is /var/www/html. Administrator users that have access to the File Abstraction Layer can create new file storage definitions pointing to directories outside the project root, bypassing the path validation. The flaw affects TYPO3 CMS versions before 10.4.57, 11.0.0‑11.5.50, 12.0.0‑12.4.45, 13.0.0‑13.4.30 and 14.0.0‑14.3.2.

TYPO3 CMS versions before 10.4.57, 11.0.0–11.5.50, 12.0.0–12.4.45, 13.0.0–13.4.30, and 14.0.0–14.3.2 are vulnerable.

The CVSS score of 2.1 indicates a low severity from a technical perspective. Because the vulnerability is only exploitable by users who already have administrative access to the File Abstraction Layer, the risk is limited to environments where an attacker can compromise an administrator account. The EPSS score is less than 1% and the issue is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. Nevertheless, the bug permits an attacker with the required privileges to access or alter files outside the designated project root.