CVE-2017-14251

Published: Sep 11, 2017Modified: May 13, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.

Affected (42)

Products: Typo3: Typo3

Typo3

1 product

Typo3

Configuration A

42 vulnerable

Vulnerable Software	Affected Versions
Typo3 Typo3	Version 7.6.0
Typo3 Typo3	Version 7.6.10
Typo3 Typo3	Version 7.6.11
Typo3 Typo3	Version 7.6.12
Typo3 Typo3	Version 7.6.13
Typo3 Typo3	Version 7.6.14
Typo3 Typo3	Version 7.6.15
Typo3 Typo3	Version 7.6.16
Typo3 Typo3	Version 7.6.17
Typo3 Typo3	Version 7.6.18
Typo3 Typo3	Version 7.6.19
Typo3 Typo3	Version 7.6.1
Typo3 Typo3	Version 7.6.20
Typo3 Typo3	Version 7.6.21
Typo3 Typo3	Version 7.6.2
Typo3 Typo3	Version 7.6.3
Typo3 Typo3	Version 7.6.4
Typo3 Typo3	Version 7.6.5
Typo3 Typo3	Version 7.6.6
Typo3 Typo3	Version 7.6.7
Typo3 Typo3	Version 7.6.8
Typo3 Typo3	Version 7.6.9
Typo3 Typo3	Version 8.0.0
Typo3 Typo3	Version 8.0.1
Typo3 Typo3	Version 8.1.0
Typo3 Typo3	Version 8.1.1
Typo3 Typo3	Version 8.1.2
Typo3 Typo3	Version 8.2.0
Typo3 Typo3	Version 8.2.1
Typo3 Typo3	Version 8.3.0
Typo3 Typo3	Version 8.3.1
Typo3 Typo3	Version 8.4.0
Typo3 Typo3	Version 8.4.1
Typo3 Typo3	Version 8.5.0
Typo3 Typo3	Version 8.5.1
Typo3 Typo3	Version 8.6.0
Typo3 Typo3	Version 8.6.1
Typo3 Typo3	Version 8.7.0
Typo3 Typo3	Version 8.7.1
Typo3 Typo3	Version 8.7.2
Typo3 Typo3	Version 8.7.3
Typo3 Typo3	Version 8.7.4