CVE-2026-112069
Broken Access Control in extension "FAL Protect" (fal_protect)
TYPO3 Extension "FAL Protect"Applications & CMS
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.47%Chance of exploitation activity in the next 30 days, higher than 40% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.8.2Extension "FAL Protect"CVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is only exploitable when the extension is used on a website running TYPO3 14.3.
Text from CVE List
Affected versions 1
- Extension "FAL Protect"affected: 1.7.1 before 1.8.2CVE List