Description
In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
Remediation
References
Related Vulnerabilities
WordPress Plugin UK Cookie Cross-Site Request Forgery (1.1)
WordPress Plugin Team Members Cross-Site Scripting (5.1.0)
Grafana Improper Input Validation Vulnerability (CVE-2022-39306)
WordPress Plugin FileBird-WordPress Media Library Folders & File Manager Cross-Site Scripting (2.4)
WordPress Plugin Easy Preloader Cross-Site Scripting (1.0.0)