{"id":"CVE-2026-112069","published":"2026-10-20T10:17:04.140","lastModified":"2026-10-20T19:28:52.970","description":"The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2026-028","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}