CVE-2026-49133: Typemill Path Traversal Vulnerability – File Read via Author Privileges

Technical summary

The vulnerability exists in the Storage::getFile() method, which processes a path query parameter without adequate validation when an empty folder argument is supplied. Although Storage::getFolderPath() implements traversal-prevention controls, an attacker can circumvent these controls by manipulating the path parameter directly. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and permits arbitrary file read access with authenticated Author-level privileges. The attack vector is network-based with low complexity and no user interaction required.

Business impact

A compromised or malicious Author account can exfiltrate sensitive configuration files, database credentials, private keys, or other confidential data stored on the same server as the Typemill installation. This could lead to secondary breaches, privilege escalation, or lateral movement within the environment. Organizations running Typemill in multi-tenant or shared-hosting scenarios face elevated risk, as Author accounts may be delegated to contractors or less-trusted staff.

Affected systems

Typemill versions before 2.24.0 are affected. The vulnerability requires authenticated access at the Author privilege level or higher, meaning systems with restricted user management are at lower immediate risk. Installations where Author credentials are widely distributed or where account compromise is suspected should be prioritized for patching.

Exploitability

The barrier to exploitation is moderate. An attacker must possess valid Author-level credentials, but once authenticated, the attack requires only a standard HTTP request with a crafted path parameter—no complex exploitation techniques or user interaction is necessary. The low complexity and network accessibility make this practical to exploit for any insider with Author permissions or an attacker who has obtained legitimate credentials through phishing or credential compromise.

Remediation

Upgrade Typemill to version 2.24.0 or later, which patches the traversal-prevention bypass. Verify the upgrade against the vendor's official advisory to confirm the specific patched version. Organizations should also audit Author account usage, revoke unnecessary credentials, and review access logs for any suspicious file-read patterns during the vulnerability window.

Patch guidance

Apply Typemill version 2.24.0 or newer as soon as feasible. Before patching, isolate or restrict network access to Author management interfaces if possible. Test the upgrade in a non-production environment to confirm compatibility with custom plugins or configurations. The patch directly addresses the validation logic in Storage::getFile() to prevent traversal sequences from bypassing folder-level restrictions.

Detection guidance

Monitor access logs for HTTP requests to Typemill's file-handling endpoints (typically those invoking Storage::getFile()) that contain path traversal patterns such as ../, ..\, or URL-encoded variants (%2e%2e%2f). Flag requests from Author-level accounts attempting to read files outside expected content directories. Log analysis should focus on the query parameter where the path is supplied. Consider deploying a Web Application Firewall (WAF) rule to block requests containing path traversal sequences in parameters known to feed Storage::getFile().

Why prioritize this

Although rated MEDIUM severity (CVSS 6.5) and not yet on the KEV catalog, this vulnerability should be prioritized for organizations with multi-user Typemill deployments or where Author accounts are less tightly controlled. The confidentiality impact is high, the attack requires only low complexity, and no exploit public disclosure or active in-the-wild campaign is necessary to justify swift patching. The authentication requirement does lower risk compared to unauthenticated flaws, but insider threats and credential compromise remain realistic attack vectors.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects high confidentiality impact (C:H), no integrity or availability impact (I:N, A:N), low attack complexity (AC:L), and required but not privileged authentication (PR:L). The network-accessible vector (AV:N) and lack of user interaction (UI:N) offset the requirement for Author-level privileges. This score appropriately weights the risk as moderate—serious for sensitive data environments but not critical infrastructure-level threat.

Frequently asked questions