CVE-2026-71518: Typemill Auth Bypass Vulnerability

CVE-2026-71518 Overview

CVE-2026-71518 is an authorization bypass vulnerability in Typemill versions prior to 2.26.0. The flaw exists in the media file download route, which enforces role-based restriction checks against a supplied filename without first normalizing the path. Unauthenticated attackers can submit path-equivalent URL variants such as dot-slash prefixes, double slashes, or percent-encoded sequences. These variants bypass the restriction logic while the underlying filesystem still resolves the request to the protected file. The result is unauthorized file download without credentials. The issue is classified under CWE-863: Incorrect Authorization.

Critical Impact
Remote unauthenticated attackers can retrieve restricted media files from Typemill installations by manipulating path representations to defeat role-based access checks.

Affected Products

Typemill flat-file CMS versions prior to 2.26.0
Typemill deployments exposing the media file download route to the network
Any Typemill instance relying on filerestrictions.yaml role-based file access controls

Discovery Timeline

2026-08-17 - CVE-2026-71518 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-71518

Vulnerability Analysis

Typemill is a flat-file content management system written in PHP. The vulnerable code path resides in system/typemill/Controllers/ControllerWebDownload.php, which handles authenticated media downloads. The controller consulted filerestrictions.yaml to decide whether a given filename could be served based on the requester's role. However, the comparison operated on the raw filename supplied in the request, while the actual file read used the operating system's path resolution. This mismatch produced a classic path-equivalence authorization bypass, where two syntactically different strings refer to the same file on disk but only one form is checked against the policy.

Root Cause

The root cause is missing input canonicalization before authorization. The restriction check treated the request path as a literal key, so variants such as ./secret.pdf, //secret.pdf, or %2Fsecret.pdf did not match entries in the restriction list. The filesystem, in contrast, collapsed these forms and returned the protected file. The upstream fix at commit 8c621063b4697a94342cb0a4b3905adda60e3d25 introduces a normalizeFilename() step that runs before the restriction lookup and rejects requests that fail to normalize.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP GET request to the media download endpoint, substituting a path-equivalent form of the target filename. Because no credentials are required and the payload consists only of a URL variant, exploitation is trivial and does not require user interaction.

php

 			return $response->withStatus(404);
 		}
 
+		# normalize path to prevent path-equivalence bypasses
+		$normalizedFilename = $this->normalizeFilename($filename);
+		if($normalizedFilename === false)
+		{
+			$response->getBody()->write(Translations::translate('the requested file does not exist.'));
+			return $response->withStatus(404);
+		}
+
 		$storage 		= new StorageWrapper('\Typemill\Models\Storage');
 		$restrictions 	= $storage->getYaml('fileFolder', '', 'filerestrictions.yaml');

Source: GitHub Commit 8c62106. The patch adds normalizeFilename() and returns HTTP 404 for any filename that cannot be normalized, ensuring the restriction lookup and the filesystem read agree on the target.

Detection Methods for CVE-2026-71518

Indicators of Compromise

HTTP requests to Typemill media download routes containing ./, ../, //, or percent-encoded slash and dot sequences in the filename parameter
Successful HTTP 200 responses returning files that should be restricted by filerestrictions.yaml
Unauthenticated download activity for media resources outside the public content tree

Detection Strategies

Inspect web server access logs for download URLs containing encoded traversal tokens such as %2E%2F, %2F%2F, or leading ./ prefixes.
Compare requested filenames against the filerestrictions.yaml policy and alert when restricted resources are served without an authenticated session cookie.
Deploy a web application firewall rule that normalizes request paths and blocks non-canonical filename forms targeting the Typemill download route.

Monitoring Recommendations

Track anomalous volumes of media download requests originating from a single source IP against Typemill hosts.
Alert on responses returning protected file types (for example, YAML, configuration, or backup files) to unauthenticated clients.
Correlate download activity with the absence of prior authentication events for the same session identifier.

How to Mitigate CVE-2026-71518

Immediate Actions Required

Upgrade all Typemill installations to version 2.26.0 or later, which includes the normalizeFilename() fix.
Audit filerestrictions.yaml and confirm that sensitive assets are declared with canonical paths.
Review web server logs for prior exploitation attempts using path-equivalent variants.

Patch Information

The fix is delivered in Typemill Release v2.26.0 and implemented in GitHub Commit 8c62106. Additional analysis is available in the VulnCheck Authorization Bypass Advisory.

Workarounds

Restrict network access to the Typemill administrative and media download routes to trusted IP ranges until patching is complete.
Place Typemill behind a reverse proxy configured to canonicalize and reject non-normalized request paths.
Temporarily disable the media file download route if it is not required for site operation.

bash

# Nginx reverse proxy hardening example
location ~ ^/media/download/ {
    # Reject requests containing traversal or double-slash patterns
    if ($request_uri ~* "(\.\./|//|%2e%2e|%2f%2f|%2e/)") {
        return 404;
    }
    proxy_pass http://typemill_backend;
}