{"id":"CVE-2017-14251","details":"Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.","aliases":["GHSA-fh4q-hxrw-cjqq"],"modified":"2026-08-27T03:47:23.801497753Z","published":"2017-09-11T09:29:00.467Z","database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"typo3:typo3","cpes":["cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.6.0"},{"last_affected":"7.6.0"}]}]},"references":[{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/100620"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1039295"},{"type":"ARTICLE","url":"http://blog.emaze.net/2017/12/typo3-unrestricted-file-upload-remote.html"},{"type":"EVIDENCE","url":"https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-007/"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/TYPO3/typo3","events":[{"introduced":"a2585ba26b9df87ef67fdbb4f53d2f1a891d919f"},{"last_affected":"c7c31332ac2222d03f29be627de34bb58bde0954"}],"database_specific":{"cpe":["cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.9:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.10:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.11:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.12:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.13:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.14:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.15:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.16:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.17:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.18:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.19:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.20:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.21:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.1.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.1.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.2.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.2.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.3.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.3.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.4.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.4.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.5.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.5.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.6.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.6.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.3:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.6.0"},{"last_affected":"7.6.0"},{"introduced":"7.6.1"},{"last_affected":"7.6.1"},{"introduced":"7.6.2"},{"last_affected":"7.6.2"},{"introduced":"7.6.3"},{"last_affected":"7.6.3"},{"introduced":"7.6.4"},{"last_affected":"7.6.4"},{"introduced":"7.6.5"},{"last_affected":"7.6.5"},{"introduced":"7.6.6"},{"last_affected":"7.6.6"},{"introduced":"7.6.7"},{"last_affected":"7.6.7"},{"introduced":"7.6.8"},{"last_affected":"7.6.8"},{"introduced":"7.6.9"},{"last_affected":"7.6.9"},{"introduced":"7.6.10"},{"last_affected":"7.6.10"},{"introduced":"7.6.11"},{"last_affected":"7.6.11"},{"introduced":"7.6.12"},{"last_affected":"7.6.12"},{"introduced":"7.6.13"},{"last_affected":"7.6.13"},{"introduced":"7.6.14"},{"last_affected":"7.6.14"},{"introduced":"7.6.15"},{"last_affected":"7.6.15"},{"introduced":"7.6.16"},{"last_affected":"7.6.16"},{"introduced":"7.6.17"},{"last_affected":"7.6.17"},{"introduced":"7.6.18"},{"last_affected":"7.6.18"},{"introduced":"7.6.19"},{"last_affected":"7.6.19"},{"introduced":"7.6.20"},{"last_affected":"7.6.20"},{"introduced":"7.6.21"},{"last_affected":"7.6.21"},{"introduced":"8.0.0"},{"last_affected":"8.0.0"},{"introduced":"8.0.1"},{"last_affected":"8.0.1"},{"introduced":"8.1.0"},{"last_affected":"8.1.0"},{"introduced":"8.1.1"},{"last_affected":"8.1.1"},{"introduced":"8.1.2"},{"last_affected":"8.1.2"},{"introduced":"8.2.0"},{"last_affected":"8.2.0"},{"introduced":"8.2.1"},{"last_affected":"8.2.1"},{"introduced":"8.3.0"},{"last_affected":"8.3.0"},{"introduced":"8.3.1"},{"last_affected":"8.3.1"},{"introduced":"8.4.0"},{"last_affected":"8.4.0"},{"introduced":"8.4.1"},{"last_affected":"8.4.1"},{"introduced":"8.5.0"},{"last_affected":"8.5.0"},{"introduced":"8.5.1"},{"last_affected":"8.5.1"},{"introduced":"8.6.0"},{"last_affected":"8.6.0"},{"introduced":"8.6.1"},{"last_affected":"8.6.1"},{"introduced":"8.7.0"},{"last_affected":"8.7.0"},{"introduced":"8.7.1"},{"last_affected":"8.7.1"},{"introduced":"8.7.2"},{"last_affected":"8.7.2"},{"introduced":"8.7.3"},{"last_affected":"8.7.3"},{"introduced":"8.7.4"},{"last_affected":"8.7.4"}],"source":"CPE_STRING"}}],"versions":["7.6.0","7.6.1","7.6.10","7.6.11","7.6.12","7.6.13","7.6.14","7.6.15","7.6.16","7.6.17","7.6.18","7.6.19","7.6.2","7.6.20","7.6.21","7.6.3","7.6.4","7.6.5","7.6.6","7.6.7","7.6.8","7.6.9","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.2.1","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.6.0","8.6.1","8.7.0","8.7.1","8.7.2","8.7.3","8.7.4","v8.7.4","TYPO3_8-7-4","TYPO3_8-7-2","TYPO3_8-7-1","TYPO3_8-7-0","TYPO3_8-6-0","TYPO3_8-5-0","TYPO3_8-4-0","TYPO3_8-3-0","TYPO3_8-2-0","TYPO3_8-1-0","TYPO3_8-0-0","TYPO3_7-6-2","TYPO3_7-6-1","TYPO3_7-6-0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14251.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/benjaminkott/bootstrap_package","events":[{"introduced":"2948aa3f9c34483477af9d18f89423eae07ede34"},{"last_affected":"86bdd2dec46ddc0c25c65b4695160ae14b3b4679"}],"database_specific":{"cpe":["cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"8.0.0"},{"last_affected":"8.0.0"},{"introduced":"8.0.1"},{"last_affected":"8.0.1"}],"source":"CPE_STRING"}}],"versions":["8.0.0","8.0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14251.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/typo3/typo3","events":[{"introduced":"a2585ba26b9df87ef67fdbb4f53d2f1a891d919f"},{"last_affected":"c7c31332ac2222d03f29be627de34bb58bde0954"}],"database_specific":{"cpe":["cpe:2.3:a:typo3:typo3:7.6.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.3:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.4:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.5:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.6:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.7:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.8:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.9:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.10:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.11:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.12:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.13:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.14:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.15:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.16:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.17:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.18:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.19:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.20:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:7.6.21:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.0.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.0.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.1.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.1.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.1.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.2.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.2.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.3.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.3.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.4.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.4.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.5.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.5.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.6.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.6.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.0:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.1:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.2:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.3:*:*:*:*:*:*:*","cpe:2.3:a:typo3:typo3:8.7.4:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.6.0"},{"last_affected":"7.6.0"},{"introduced":"7.6.1"},{"last_affected":"7.6.1"},{"introduced":"7.6.2"},{"last_affected":"7.6.2"},{"introduced":"7.6.3"},{"last_affected":"7.6.3"},{"introduced":"7.6.4"},{"last_affected":"7.6.4"},{"introduced":"7.6.5"},{"last_affected":"7.6.5"},{"introduced":"7.6.6"},{"last_affected":"7.6.6"},{"introduced":"7.6.7"},{"last_affected":"7.6.7"},{"introduced":"7.6.8"},{"last_affected":"7.6.8"},{"introduced":"7.6.9"},{"last_affected":"7.6.9"},{"introduced":"7.6.10"},{"last_affected":"7.6.10"},{"introduced":"7.6.11"},{"last_affected":"7.6.11"},{"introduced":"7.6.12"},{"last_affected":"7.6.12"},{"introduced":"7.6.13"},{"last_affected":"7.6.13"},{"introduced":"7.6.14"},{"last_affected":"7.6.14"},{"introduced":"7.6.15"},{"last_affected":"7.6.15"},{"introduced":"7.6.16"},{"last_affected":"7.6.16"},{"introduced":"7.6.17"},{"last_affected":"7.6.17"},{"introduced":"7.6.18"},{"last_affected":"7.6.18"},{"introduced":"7.6.19"},{"last_affected":"7.6.19"},{"introduced":"7.6.20"},{"last_affected":"7.6.20"},{"introduced":"7.6.21"},{"last_affected":"7.6.21"},{"introduced":"8.0.0"},{"last_affected":"8.0.0"},{"introduced":"8.0.1"},{"last_affected":"8.0.1"},{"introduced":"8.1.0"},{"last_affected":"8.1.0"},{"introduced":"8.1.1"},{"last_affected":"8.1.1"},{"introduced":"8.1.2"},{"last_affected":"8.1.2"},{"introduced":"8.2.0"},{"last_affected":"8.2.0"},{"introduced":"8.2.1"},{"last_affected":"8.2.1"},{"introduced":"8.3.0"},{"last_affected":"8.3.0"},{"introduced":"8.3.1"},{"last_affected":"8.3.1"},{"introduced":"8.4.0"},{"last_affected":"8.4.0"},{"introduced":"8.4.1"},{"last_affected":"8.4.1"},{"introduced":"8.5.0"},{"last_affected":"8.5.0"},{"introduced":"8.5.1"},{"last_affected":"8.5.1"},{"introduced":"8.6.0"},{"last_affected":"8.6.0"},{"introduced":"8.6.1"},{"last_affected":"8.6.1"},{"introduced":"8.7.0"},{"last_affected":"8.7.0"},{"introduced":"8.7.1"},{"last_affected":"8.7.1"},{"introduced":"8.7.2"},{"last_affected":"8.7.2"},{"introduced":"8.7.3"},{"last_affected":"8.7.3"},{"introduced":"8.7.4"},{"last_affected":"8.7.4"}],"source":"CPE_STRING"}}],"versions":["7.6.0","7.6.1","7.6.10","7.6.11","7.6.12","7.6.13","7.6.14","7.6.15","7.6.16","7.6.17","7.6.18","7.6.19","7.6.2","7.6.20","7.6.21","7.6.3","7.6.4","7.6.5","7.6.6","7.6.7","7.6.8","7.6.9","8.0.0","8.0.1","8.1.0","8.1.1","8.1.2","8.2.0","8.2.1","8.3.0","8.3.1","8.4.0","8.4.1","8.5.0","8.5.1","8.6.0","8.6.1","8.7.0","8.7.1","8.7.2","8.7.3","8.7.4","v8.7.4","TYPO3_8-7-4","TYPO3_8-7-2","TYPO3_8-7-1","TYPO3_8-7-0","TYPO3_8-6-0","TYPO3_8-5-0","TYPO3_8-4-0","TYPO3_8-3-0","TYPO3_8-2-0","TYPO3_8-1-0","TYPO3_8-0-0","TYPO3_7-6-2","TYPO3_7-6-1","TYPO3_7-6-0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-14251.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}