TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2 contain a path traversal vulnerability (CWE-22) in the GeneralUtility::isAllowedAbsPath() function. The function performs a plain string prefix comparison without enforcing a directory separator boundary, causing paths like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root is /var/www/html. This flaw allows administrator users with access to the File Abstraction Layer to bypass path restrictions by creating new file storage definitions that point outside the intended project root directory. The vulnerability requires administrator privileges and does not allow user interaction, with a low overall impact as reflected by a CVSS 4.0 score of 2.1.

An attacker with administrator privileges and access to the File Abstraction Layer can bypass path restrictions to create file storage definitions pointing outside the project root directory. This could lead to unauthorized access to files outside the intended directory scope. However, exploitation requires high privileges, and the overall impact is limited, as indicated by the low CVSS score.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and review file storage definitions for unauthorized paths outside the project root.