--- title: "TYPO3-EXT-SA-2017-008: Multiple vulnerabilities in extension \"File manager\" (ameos_filemanager)" url: "https://news.typo3.com/security/advisory/typo3-ext-sa-2017-008" description: "It has been discovered that the extension \"File manager\" (ameos_filemanager) is susceptible to Remote Code Execution, SQL Injection and Information Disclosure." image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - TYPO3 Extensions --- # TYPO3-EXT-SA-2017-008: Multiple vulnerabilities in extension "File manager" (ameos_filemanager) - Security / [TYPO3 Extensions](https://news.typo3.com/article/category/security/typo3-extensions) TYPO3-EXT-SA-2017-008: Multiple vulnerabilities in extension "File manager" (ameos\_filemanager) ================================================================================================ 07 November 2017 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that the extension "File manager" (ameos\_filemanager) is susceptible to Remote Code Execution, SQL Injection and Information Disclosure. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/e4eaa13e33dd086a9c06f2570cb34609.jpeg)[Torben Hansen](https://news.typo3.com/article/author/torben-hansen) **Release Date:** November 07, 2017 **Component Type:** Third party extension. This extension is not a part of the TYPO3 default installation. **Affected Versions:** version 1.0.1 and below **Vulnerability Type:** Remote Code Execution, SQL Injection, Information Disclosure **Severity:** Critical **Suggested CVSS v3.0:** [AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C "CVSS calculator") ([What's that?](http://buzz.typo3.org/teams/security/article/use-of-common-vulnerability-scoring-system-in-typo3-security-advisories/ "Blog post on CVSS usage")) **CVE:** not assigned yet **Problem Description:** A missing access check in the extension allows an unauthenticated user to upload arbitrary files to the fileadmin folder. Another missing access check allows an unauthenticated user to view file information (filename, description, keywords, categories) of any file in the fileadmin folder by modifying a GET parameter. Failing to properly escape user input, the extension is also susceptible to SQL Injection. **Solution:** An updated version 1.0.2 is available from the TYPO3 Extension Manager and at [https://extensions.typo3.org/extension/download/ameos\_filemanager/1.0.2/zip/](https://extensions.typo3.org/extension/download/ameos_filemanager/1.0.2/zip/ "Opens external link in new window"). Users of the extension are advised to update the extension as soon as possible. **Credits**: Credits go to Michael Helwig who discovered and reported the vulnerability. **General advice:** Follow the recommendations that are given in the [TYPO3 Security Guide](http://docs.typo3.org/typo3cms/SecurityGuide/ "Initiates file download"). Please subscribe to the [typo3-announce mailing list](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce "Opens external link in new window") to receive future Security Bulletins via E-mail. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/7cf52722a5b7183b29d378a2284bd103.jpeg) About the Author [Torben Hansen](https://news.typo3.com/article/author/torben-hansen) Open Source Enthusiast & TYPO3 Expert I’m a passionate open-source advocate and dedicated TYPO3 expert. As a freelancer, I offer professional TYPO3 services to clients while actively contributing to the TYPO3 ecosystem. I have developed several public TYPO3 extensions and serve as the Co-Lead of the TYPO3 Security Team, helping to enhance the platform’s security and functionality. For many years, I have been blogging about TYPO3, sharing insights and expertise with the community. [More posts by this author](https://news.typo3.com/article/author/torben-hansen)