Description
In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
Remediation
References
Related Vulnerabilities
osTicket Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2017-15580)
Internet Information Services CVE-2009-4444 Vulnerability (CVE-2009-4444)
Drupal Core 4.7.x Multiple Cross-Site Scripting Vulnerabilities (4.7.0 - 4.7.6)
WordPress Plugin 10Web AI Assistant-AI content writing assistant Security Bypass (1.0.18)
Oracle Database Server CVE-2006-0282 Vulnerability (CVE-2006-0282)