fabarea media_upload UploadFileService.php getUploadedFileList pathname traversal

Published 3 y ago 2023-01-10 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.5

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.9%

percentile 60%

Public exploits

none known

A vulnerability has been found in fabarea media_upload on TYPO3 and classified as critical. This vulnerability affects the function getUploadedFileList of the file Classes/Service/UploadFileService.php. The manipulation leads to pathname traversal. Upgrading to version 0.9.0 is able to address this issue. The patch is identified as b25d42a4981072321c1a363311d8ea2a4ac8763a. It is recommended to upgrade the affected component. VDB-217786 is the identifier assigned to this vulnerability.

Exploit prediction (EPSS)

0.90% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.1	5.5	`CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`
CNA	3.0	5.5	`CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`
CNA	2.0	5.2	`AV:A/AC:L/Au:S/C:P/I:P/A:P`
CNA	3.1	5.5	`CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`
NVD	3.1	9.8	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
CNA	2.0	5.2	`AV:A/AC:L/Au:S/C:P/I:P/A:P`

Affected products

fabarea media_upload

Classification

Weakness

CWE-21 DEPRECATED: Pathname Traversal and Equivalence Errors
CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

vuldb.com /?id.217786 · vdb-entry, technical-description, x_transferred
vuldb.com /?ctiid.217786 · signature, permissions-required, x_transferred
github.com /fabarea/media_upload/issues/6 · issue-tracking, x_transferred
github.com /fabarea/media_upload/commit/b25d42a4981072321c1a363311d8ea2a4ac8763a · patch, x_transferred
github.com /fabarea/media_upload/releases/tag/0.9.0 · patch, x_transferred

Sources

CVE List: CVE-2016-15017
NVD: CVE-2016-15017

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.