CVE-2026-49133: Typemill Path Traversal Vulnerability

CVE-2026-49133 Overview

CVE-2026-49133 is a path traversal vulnerability [CWE-22] in Typemill, a flat-file content management system written in PHP. Versions before 2.24.0 allow authenticated attackers holding Author-level privileges to read arbitrary files outside the intended content directory. The flaw resides in Storage::getFile(), where supplying traversal sequences in the path query parameter with an empty folder argument bypasses sanitization in Storage::getFolderPath(). Attackers can retrieve sensitive files such as configuration data, credentials, and source code from the host filesystem.

Critical Impact
Authenticated Author-level users can read arbitrary files on the server filesystem, exposing credentials, configuration secrets, and application source code.

Affected Products

Typemill versions prior to 2.24.0
Typemill Storage::getFile() API endpoint
Typemill ControllerApiImage::getPagemedia controller

Discovery Timeline

2026-06-17 - CVE-2026-49133 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-49133

Vulnerability Analysis

The vulnerability exists in Typemill's file storage layer, specifically the Storage::getFile() method exposed through the ControllerApiImage::getPagemedia controller. The endpoint accepts a path query parameter that is intended to reference files within the content directory. When Storage::getFile() is invoked with an empty folder argument, the path normalization performed by Storage::getFolderPath() fails to strip directory traversal sequences.

Attackers authenticated with the Author role, the lowest privileged editorial role in Typemill, can craft requests containing ../ sequences in the path parameter. The application resolves these sequences and returns the contents of arbitrary files accessible to the PHP process. This exposes data outside the intended sandbox boundary.

Root Cause

The root cause is incomplete input validation in Storage::getFolderPath(). The function's traversal-prevention logic is conditional on a non-empty folder argument. When the folder parameter is empty, the function returns a base path without filtering the supplied path value for traversal sequences. The Storage::getFile() method then concatenates the unsanitized input directly into a filesystem read operation.

Attack Vector

Exploitation requires network access to the Typemill API and valid credentials with Author-level privileges or higher. The attacker issues an HTTP request to the media retrieval endpoint with a crafted path parameter containing traversal sequences and an empty folder argument. The server returns the contents of the targeted file, enabling extraction of settings.yaml, .htaccess, user credential stores, or arbitrary PHP source files.

The maintainers addressed the issue by hardening path resolution. The fix is included in the cache regeneration and sanitization logic landed in the v2.24.2 release.

text

// Patch reference: cache/sitemap-de.xml regenerated after sanitization fix
-<?xml version="1.0" encoding="UTF-8"?>
-<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
-  <url>
-    <loc>http://localhost/typemill</loc>
-  </url>
-  <url>
-    <loc>http://localhost/typemill/de/starten</loc>
-  </url>
-</urlset>

Source: GitHub Commit bfbb270

Detection Methods for CVE-2026-49133

Indicators of Compromise

HTTP requests to Typemill API endpoints containing ../ or URL-encoded %2e%2e%2f sequences in the path query parameter.
Web server access logs showing authenticated Author-level sessions accessing media controllers with unusual path arguments.
PHP error logs referencing file reads outside the Typemill content/ directory.

Detection Strategies

Inspect web access logs for requests to ControllerApiImage::getPagemedia or related media endpoints where the path parameter contains traversal characters.
Correlate authentication events with subsequent file-read API calls to identify low-privilege accounts accessing sensitive resources.
Deploy web application firewall rules that flag path traversal patterns against Typemill installations.

Monitoring Recommendations

Alert on responses to media API requests that return non-image MIME types or large text payloads inconsistent with media assets.
Track read access to sensitive files such as settings.yaml, .htaccess, and users/ directory contents by the PHP process.
Monitor for spikes in API request volume from individual Author-level accounts, which may indicate filesystem enumeration.

How to Mitigate CVE-2026-49133

Immediate Actions Required

Upgrade Typemill to version 2.24.2 or later, which contains the patched Storage::getFolderPath() logic.
Audit all user accounts and remove or downgrade unused Author-level and higher accounts.
Rotate any credentials, API keys, or secrets stored in Typemill configuration files that may have been exposed.

Patch Information

The fix is available in the Typemill v2.24.2 release. The corrective commit hardens path resolution so that traversal sequences are rejected regardless of the folder argument. Technical details are documented in the VulnCheck Path Traversal Advisory and the GitHub Commit bfbb270.

Workarounds

Restrict access to the Typemill admin and API endpoints by IP allowlist until the upgrade is applied.
Enforce least-privilege account assignment and disable self-registration for Author roles.
Place a web application firewall in front of Typemill with rules that block ../, ..\\, and URL-encoded traversal sequences in query parameters.

bash

# Example nginx rule to block path traversal in query strings
if ($args ~* "(\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)") {
    return 403;
}