CVE-2023-30451 is a medium-severity (CVSS 5.5) Path Traversal vulnerability in typo3/cms-core. A fix is available for typo3/cms-core — see the affected versions and patch details below.
Path Traversal in TYPO3 File Abstraction Layer Storages
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
typo3/cms-core🐘typo3/cms-core🐘typo3/cms-core🐘typo3/cms-core🐘typo3/cms-core🐘typo3/cms-coreReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Problem
Configurable storages using the local driver of the File Abstraction Layer (FAL) could be configured to access directories outside of the root directory of the corresponding project. The system setting in BE/lockRootPath was not evaluated by the file abstraction layer component. An administrator-level backend user account is required to exploit this vulnerability.
Solution
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
ℹ️ Strong security defaults - Manual actions required
see Important: #102800 changelog
Assuming that a web project is located in the directory /var/www/example.org (the "project root path" for Composer-based projects) and the publicly accessible directory is located at /var/www/example.org/public (the "public root path"), accessing resources via the File Abstraction Layer component is limited to the mentioned directories.
To grant additional access to directories, they must be explicitly configured in the system settings of $GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] - either using the Install Tool or according to deployment techniques. The existing setting has been extended to support multiple directories configured as an array of strings.
Example:
$GLOBALS['TYPO3_CONF_VARS']['BE']['lockRootPath'] = [
‘/var/shared/documents/’,
‘/var/shared/images/’,
];
❗ Storages that reference directories not explicitly granted will be marked as "offline" internally - no resources can be used in the website's frontend and backend context.
Credits
Thanks to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue.
References
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | typo3/cms-core | ≥ 8.0.0&&< 8.7.57 | 8.7.57composer require typo3/cms-core:^8.7.57 |
| 🐘Packagist | typo3/cms-core | ≥ 9.0.0&&< 9.5.46 | 9.5.46composer require typo3/cms-core:^9.5.46 |
| 🐘Packagist | typo3/cms-core | ≥ 10.0.0&&< 10.4.43 | 10.4.43composer require typo3/cms-core:^10.4.43 |
| 🐘Packagist | typo3/cms-core | ≥ 11.0.0&&< 11.5.35 | 11.5.35composer require typo3/cms-core:^11.5.35 |
| 🐘Packagist | typo3/cms-core | ≥ 12.0.0&&< 12.4.11 | 12.4.11composer require typo3/cms-core:^12.4.11 |
| 🐘Packagist | typo3/cms-core | ≥ 13.0.0&&< 13.0.1 | 13.0.1composer require typo3/cms-core:^13.0.1 |
Affected Products
typo3typo3Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for typo3/cms-core, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update typo3/cms-core to 8.7.57 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2023-30451 is resolved across your whole dependency graph.
Workarounds
Resolve every user-supplied path to its canonical form and reject anything that escapes the intended directory, and run the component under an account that has no read or write access outside the directory it legitimately serves.
Frequently Asked Questions
Is CVE-2023-30451 in your dependencies?
Find it across Packagist, including transitive dependencies.