The TYPO3 extension "Mask" fails to properly validate client-supplied template element keys before using them to construct file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can exploit this flaw by providing keys with path traversal sequences, enabling unauthorized creation or deletion of .html files outside the configured template directory. This vulnerability is identified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

An attacker with authenticated backend access to the Mask module can manipulate file paths to create or delete .html files outside the intended template directory. This could lead to unauthorized modification or deletion of files, potentially impacting the integrity of the system or its content. The CVSS 4.0 score is 6.0 (medium severity), reflecting the requirement for authenticated access and limited scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, restrict backend user access to trusted personnel only and monitor for suspicious activity related to the Mask module.