CVE-2026-49133 — Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content direc…
Published: 2026-06-17 · CVSS: 7.1 · CVSS 4.0
Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile() with an empty folder argument. Attackers can bypass traversal-prevention controls in Storage::getFolderPath() to access sensitive files.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7