VULNERABILITY INTELLIGENCE

CVE-2013-4250

CVSS score6.5 MEDIUM
EPSS probability1.15%
CISA KEVNot currently listed
Published2014-05-20
Last modified2026-06-16
CVSS vectorAV:N/AC:L/Au:S/C:P/I:P/A:P

Description

The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.

Weakness classification

  • CWE-20: Improper Input Validation

Primary references