Description
TYPO3是瑞士TYPO3协会维护的一套免费开源的内容管理系统(框架)(CMS/CMF)。 TYPO3 6.0.8之前的6.0.x版本和6.1.3之前的6.1.x版本中的文件上传组件和File Abstraction Layer (FAL)中存在安全漏洞，该漏洞源于程序没有正确检查文件扩展名。远程攻击者可通过上传PHP文件利用该漏洞执行任意PHP代码。
TYPO3 Backend File Upload/FAL扩展任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://typo3.org/security/advisory/typo3-core-sa-2025-014
https://github.com/advisories/GHSA-9hq9-cr36-4wpj
https://vulert.com/vuln-db/CVE-2025-47939
https://cve.imfht.com/intel/401468?lang=en
https://www.acunetix.com/vulnerabilities/web/typo3-unrestricted-upload-of-file-with-dangerous-type-vulnerability-cve-2021-21357/
https://nvd.nist.gov/vuln/detail/CVE-2025-47939