Vulnerability in TYPO3 Extension "FAL Protect"

[ Description ]Official description

The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund19 Oct 2026WID-SEC-2026-4053

  TYPO3 Extensions: Multiple vulnerabilities Translated from German

  CVE-2026-113468CVE-2026-112239CVE-2026-112068+12 more CVEs

[ References ]References

• typo3.org/security/advisory/typo3-ext-sa-2026-028