CVE-2017-14251

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequently execute arbitrary PHP code.

• CWE-434

• http://blog.emaze.net/2017/12/typo3-unrestricted-file-upload-remote.html
• http://www.securityfocus.com/bid/100620Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039295Third Party Advisory, VDB Entry
• https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-007/Exploit, Vendor Advisory
• http://blog.emaze.net/2017/12/typo3-unrestricted-file-upload-remote.html
• http://www.securityfocus.com/bid/100620Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1039295Third Party Advisory, VDB Entry
• https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2017-007/Exploit, Vendor Advisory

Published

Sep 11, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14246An out of bounds read in the function d2ulaw_array() in ulaw…
• CVE-2017-14247SQL Injection exists in the EyesOfNetwork web interface (aka…
• CVE-2017-14248A heap-based buffer over-read in SampleImage() in MagickCore…
• CVE-2017-14249ImageMagick 7.0.6-8 Q16 mishandles EOF checks in ReadMPCImag…
• CVE-2017-1425IBM Business Process Manager 8.0.1.1 and 8.5.7 is vulnerable…
• CVE-2017-14250Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2017-14252SQL Injection exists in the EyesOfNetwork web interface (aka…
• CVE-2017-14257In the SDK in Bento4 1.5.0-616, AP4_AtomSampleTable::GetSamp…
• CVE-2017-14258In the SDK in Bento4 1.5.0-616, SetItemCount in Core/Ap4Stsc…
• CVE-2017-14259In the SDK in Bento4 1.5.0-616, the AP4_StscAtom class in Ap…
• CVE-2017-14260In the SDK in Bento4 1.5.0-616, the AP4_StssAtom class in Ap…
• CVE-2017-14261In the SDK in Bento4 1.5.0-616, the AP4_StszAtom class in Ap…