CVE-2026-77139: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in TYPO3 Extension "Mask"

The TYPO3 Mask extension fails to validate a client-supplied template element key, which is used to construct file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can exploit this by including path traversal sequences in the key, enabling creation or deletion of .html files outside the configured template directory. This improper limitation of pathname to a restricted directory is classified as CWE-22. The vulnerability affects Mask extension versions >=9.0.0 and <9.0.11, and >=0 and <8.3.12.

An authenticated backend user with access to the Mask module can manipulate file paths to create or delete .html files outside the intended template directory. This could lead to unauthorized modification or deletion of files on the server within the web root or other accessible directories, potentially impacting site integrity or availability. However, exploitation requires authenticated backend access, limiting the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict backend user access to the Mask module to trusted administrators only. Monitor for updates from TYPO3 regarding patches or official fixes for this vulnerability.