GHSA-67wg-6j7r-mqh8: Arbitrary Code Execution in TYPO3 CMS

June 5, 2024

Due to a missing file extension in the fileDenyPattern, backend user are allowed to upload *.pht files which can be executed in certain web server setups. The new default fileDenyPattern is the following, which might have been overridden in the TYPO3 Install Tool.

\.(php[3-7]?|phpsh|phtml|pht)(\..*)?$|^\.htaccess$

References

github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2017-09-05-4.yaml
github.com/TYPO3/typo3
github.com/advisories/GHSA-67wg-6j7r-mqh8
typo3.org/security/advisory/typo3-core-sa-2017-007

Code Behaviors & Features

Detect and mitigate GHSA-67wg-6j7r-mqh8 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →