TYPO3 CMS contains a path traversal vulnerability caused by the GeneralUtility::isAllowedAbsPath() function performing a plain string prefix comparison without enforcing a directory separator boundary. This allows paths such as /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root is /var/www/html. Administrator users with access to the File Abstraction Layer can exploit this to create file storage definitions that point outside the intended project root directory, effectively bypassing the path check. The issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31, and 14.0.0-14.3.3.

An attacker with administrator privileges and access to the File Abstraction Layer can bypass path restrictions to define file storage locations outside the project root. This may lead to unauthorized access or manipulation of files outside the intended directory scope. The CVSS score of 2.1 (low) reflects that exploitation requires high privileges and the impact is limited to confidentiality and integrity with low scope and no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to the File Abstraction Layer to trusted users only and monitor for any unauthorized file storage definitions pointing outside the project root.