TYPO3 Mask Extension Path Traversal via Template Key
CVE-2026-77139 Published on August 25, 2026
Path Traversal in extension "Mask" (mask)
The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.
Vulnerability Analysis
CVE-2026-77139 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-77139 has been classified to as a Directory traversal vulnerability or weakness.
External Control of File Name or Path
The software allows user input to control or influence paths or file names that are used in filesystem operations.
Affected Versions
TYPO3 Extension "Mask":- Version 9.0.0 and below 9.0.11 is affected.
- Before 8.3.12 is affected.