CVE-2010-5099

no score yetEPSS 3.1%

typo3 typo3: no CVSS score yet. EPSS 3.1% chance of exploitation in the next 30 days.

The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly filter file types, which allows remote attackers to bypass intended access restrictions and access arbitrary PHP files, as demonstrated using path traversal sequences with %00 null bytes and CVE-2010-3714 to read the TYPO3 encryption key from localconf.php.

EPSS: 3.1% chance of exploitation in the next 30 days; higher than 87% of CVEs (scores of 2026-10-31)
CWE: CWE-20
Published: 2012-05-30
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

typo3:typo3

References

http://blog.nibblesec.org/2010/12/typo3-sa-2010-020-typo3-sa-2010-022.html
http://secunia.com/advisories/35770
http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-sa-2010-022/
http://www.exploit-db.com/exploits/15856
http://www.openwall.com/lists/oss-security/2011/01/13/2

Check your stack JSON