CVE-2026-49742 is a path traversal vulnerability in TYPO3 CMS that permits authorized backend users with file download permissions to download files from the fallback storage of the file abstraction layer (FAL) via the Media Module. The fallback storage resolves file paths relative to the server's document root, which can lead to unauthorized access to sensitive files outside the intended storage directories. This vulnerability affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2. The CVSS 4.0 score is 7.1, indicating high severity.

Exploitation of this vulnerability allows backend users with file download permissions to access sensitive files outside the designated storage areas, including potentially sensitive server files such as logs. This could lead to unauthorized disclosure of information that may aid further attacks or compromise system confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, restrict backend user permissions to only those necessary and monitor access to the Media Module closely.