CVE-2026-77139: TYPO3 Mask Extension Path Traversal Flaw

CVE-2026-77139 Overview

CVE-2026-77139 is a path traversal vulnerability [CWE-22] affecting the TYPO3 Mask extension. The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory. TYPO3 published details in TYPO3 Security Advisory 2026-017.

Critical Impact
Authenticated backend users can create or delete arbitrary .html files outside the intended template directory, enabling integrity violations across the TYPO3 installation.

Affected Products

TYPO3 Mask extension (see TYPO3 Security Advisory 2026-017 for affected versions)
TYPO3 installations exposing the Mask module to backend users
Multi-tenant TYPO3 environments where non-administrative editors have Mask module access

Discovery Timeline

2026-08-25 - CVE-2026-77139 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77139

Vulnerability Analysis

The Mask extension for TYPO3 lets backend editors define custom content elements. When the extension saves or deletes a template, it constructs the target file path by concatenating the configured template directory with a client-supplied element key. The key is not sanitized against directory traversal sequences before it reaches the file system operation.

An authenticated user with access to the Mask module supplies a key such as ../../../typo3conf/evil in a save or delete request. The extension resolves the path outside the intended template directory and writes or removes an .html file at the resulting location. The impact focuses on integrity: attackers cannot read arbitrary files, but they can plant or remove HTML content across the web root.

Root Cause

The root cause is missing input validation on the template element key parameter. The extension trusts the client-supplied identifier and passes it into file path construction without normalizing the path, rejecting .. segments, or verifying that the resolved path stays within the configured template base directory.

Attack Vector

Exploitation requires network access to the TYPO3 backend and authenticated credentials with permission to use the Mask module. The attacker issues a normal Mask save or delete request, replacing the element key with a value containing traversal sequences. Because the extension writes only .html files, follow-on impact typically involves overwriting existing template fragments, deleting production template files to cause outages, or staging HTML payloads served by TYPO3 rendering pipelines. See the TYPO3 Security Advisory 2026-017 for exploitation preconditions.

Detection Methods for CVE-2026-77139

Indicators of Compromise

Unexpected .html files appearing outside the configured Mask template directory, particularly within typo3conf/, fileadmin/, or extension directories.
Missing or truncated Mask template files that coincide with backend user activity in the Mask module.
Backend request logs containing Mask module endpoints with element key parameters that include .., %2e%2e, or absolute path prefixes.

Detection Strategies

Review TYPO3 backend audit logs for Mask save and delete operations performed by non-administrative users.
Compare the current file inventory of template and configuration directories against a known-good baseline to identify unauthorized .html writes or deletions.
Inspect web server access logs for POST requests to Mask module routes that contain path traversal patterns in request bodies or query strings.

Monitoring Recommendations

Enable file integrity monitoring on typo3conf/, the Mask template directory, and any writable extension paths that render HTML.
Alert on new or modified .html files created by the PHP-FPM or web server user outside expected template roots.
Correlate backend authentication events with subsequent file system changes to attribute template modifications to specific accounts.

How to Mitigate CVE-2026-77139

Immediate Actions Required

Update the TYPO3 Mask extension to the fixed version listed in TYPO3 Security Advisory 2026-017.
Audit backend user accounts and revoke Mask module access from users who do not require it.
Review the file system for unauthorized .html files or missing template files created since the extension was installed.

Patch Information

TYPO3 has published fixed versions of the Mask extension. Administrators should consult TYPO3 Security Advisory 2026-017 for the exact patched release and upgrade using Composer or the Extension Manager. After patching, restart PHP-FPM or the web server to clear any cached opcode.

Workarounds

Restrict Mask module permissions to trusted administrators until the extension is updated.
Enforce least privilege on the web server user so it cannot write outside the intended template directory.
Apply mandatory access controls, such as SELinux or AppArmor profiles, that confine PHP write access to designated TYPO3 directories.

bash

# Configuration example: update the Mask extension via Composer
composer update mask/mask --with-dependencies

# Verify the installed version
composer show mask/mask | grep versions