{"id":"CVE-2024-25121","aliases":["GHSA-rj3x-wvc6-5j66"],"url":"https://o3.security/vulnerability/CVE-2024-25121","summary":"Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3","details":"### Problem\nEntities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage (\"zero-storage\") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account.\n\n\n### Solution\nUpdate to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.\n\n#### ℹ️ Strong security defaults - Manual actions required\n\nWhen persisting entities of the File Abstraction Layer directly via DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata` entities are not permitted to reference files in the fallback storage anymore.\n\nWhen importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using `$dataHandler->isImporting = true;`.\n\n### Credits\nThanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2024-006](https://typo3.org/security/advisory/typo3-core-sa-2024-006)\n","published":"2024-02-13T22:14:40.926Z","modified":"2026-10-28T02:30:35.858437926Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"8.7.57"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"9.5.46"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"10.4.43"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"11.5.35"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"12.4.11"},{"ecosystem":"Packagist","name":"typo3/cms-core","fixedVersion":"13.0.1"}],"fix":{"url":"https://github.com/TYPO3/typo3/commit/38f0bf9a61e10365be26eb75bc23a81184dbed07","label":"TYPO3/typo3@38f0bf9"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25121.json"},{"type":"ADVISORY","url":"https://github.com/TYPO3/typo3/security/advisories/GHSA-rj3x-wvc6-5j66"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-25121"},{"type":"ADVISORY","url":"https://typo3.org/security/advisory/typo3-core-sa-2024-006"},{"type":"WEB","url":"https://github.com/TYPO3/typo3/commit/38f0bf9a61e10365be26eb75bc23a81184dbed07"},{"type":"WEB","url":"https://github.com/TYPO3/typo3/commit/71e652bf84b16fd3592205f61f36750ab03db74c"},{"type":"WEB","url":"https://github.com/TYPO3/typo3/commit/b47b6ddf5a5f3f852c6e43f837360780c12e3c47"},{"type":"PACKAGE","url":"https://github.com/TYPO3/typo3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:35.858437926Z"}}