GHSA-54jj-pxx2-pv8h

TYPO3 doesn't properly check file extensions

Source: GitHub Advisory Database (reviewed) High CVE-2013-4250

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	typo3/cms	>= 6.0.0, < 6.0.8	6.0.8
Packagist	typo3/cms	>= 6.1.0, < 6.1.3	6.1.3

Details

As written in the advisory (Markdown source, shown as plain text).

The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly check file extensions, which allow remote authenticated editors to execute arbitrary PHP code by uploading a .php file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-4250 advisory
https://github.com/TYPO3/typo3 package
https://typo3.org/security/advisory/typo3-core-sa-2013-002 web