---
title: "TYPO3-CORE-SA-2019-008: Arbitrary Code Execution via File List Module"
url: "https://news.typo3.com/security/advisory/typo3-core-sa-2019-008"
description: It has been discovered, that TYPO3 CMS is vulnerable to arbitrary code execution.
image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg"
date: 2026-06-11
modified: 2026-06-11
categories:
  - "Developer & Technology"
  - TYPO3 CMS
---

# TYPO3-CORE-SA-2019-008: Arbitrary Code Execution via File List Module

- [Developer & Technology](https://news.typo3.com/article/category/developer-technology)
- Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms)

TYPO3-CORE-SA-2019-008: Arbitrary Code Execution via File List Module
=====================================================================

22 January 2019

![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp)

It has been discovered, that TYPO3 CMS is vulnerable to arbitrary code execution.

- ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/bbf959d8e683550c90ae922aff9145d8.jpeg)[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy)

- **Component Type:** TYPO3 CMS
- **Vulnerable subcomponent:** File List (ext:filelist)
- **Release Date:** January 22, 2019
- **Vulnerability Type:** Arbitrary Code Execution
- **Affected Versions:** 8.0.0-8.7.22 and 9.0.0-9.5.3
- **Severity:** None - Critical (depending on web server configuration)
- **Suggested CVSS v3.0:** [AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:F/RL:O/RC:C)
- **CVE:** not assigned yet

### Problem Description

Due to missing file extensions in *$GLOBALS\['TYPO3\_CONF\_VARS'\]\['BE'\]\[‘fileDenyPattern’\]*, backend users are allowed to upload *\*.phar*, *\*.shtml*, *\*.pl* or *\*.cgi* files which can be executed in certain web server setups. A valid backend user account is needed in order to exploit this vulnerability.

Derivatives of Debian GNU Linux are handling *\*.phar* files as PHP applications since PHP 7.1 (for unofficial packages) and PHP 7.2 (for official packages).

The file extension *\*.shtml* is bound to server side includes which are not enabled per default in most common Linux based distributions. File extension *\*.pl* and *\*.cgi* require additional handlers to be configured which is also not the case in most common distributions (except for */cgi-bin/* location).

### Solution

Update to TYPO3 versions 8.7.23 or 9.5.4 to fix the problem described.

### Credits

Thanks to Edgar Boda-Majer and Lauritz Holtmann who reported these issues and to TYPO3 core team member Oliver Hader who fixed the issue.

### General Advice

Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list.

### General Note

All security related code changes are tagged so that you can easily look them up in our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z).

![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b5c88386e5b1d8fca79d0652427922d2.jpeg)

About the Author

[Zoe Legacy](https://news.typo3.com/article/author/zoe-legacy)

[More posts by this author](https://news.typo3.com/article/author/zoe-legacy)