A backend user with file download permissions could download arbitrary files from the fallback storage of the file abstraction layer, which resolves paths relative to the server’s document root, allowing access to sensitive files such as logs. The flaw constitutes a broken access control and a path traversal vulnerability, exposing confidential information.

TYPO3 CMS has been impacted across four major branches. The vulnerable releases span from 11.0.0 to 11.5.50, 12.0.0 to 12.4.45, 13.0.0 to 13.4.30, and 14.0.0 to 14.3.2, all versions of the TYPO3 CMS product.

With a CVSS score of 7.1, the vulnerability poses a moderate to high risk. Exploitation requires an authenticated backend user with file download rights, which is likely available to many administrators. Since EPSS is not available and the issue is not listed in CISA KEV, it has not yet been confirmed as widely exploited, but the medium chance of occurrence and the potential confidentiality impact warrant prompt action.