CVE-2026-49742 is a path traversal vulnerability in TYPO3 CMS's Media Module that allows backend users with file download permissions to download files from the fallback storage of the file abstraction layer (FAL). The fallback storage resolves file paths relative to the server's document root, which can lead to unauthorized access to sensitive files outside the intended directory scope. This affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and has a high CVSS 4.0 score of 7.1, indicating significant impact if exploited. No vendor advisory or patch information is currently available.

Exploitation of this vulnerability allows backend users with file download permissions to access and download files outside the intended storage areas, including potentially sensitive files such as server log files. This could lead to unauthorized disclosure of sensitive information stored on the server. The vulnerability does not require user interaction and has a network attack vector with low complexity, increasing its risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict backend user permissions to only those absolutely necessary and monitor access to the Media Module. Avoid granting file download permissions broadly. Follow TYPO3 vendor channels for updates on patches or official mitigations.