TYPO3-EXT-SA-2026-017: Path Traversal in extension "Mask" (mask)

• Release Date: August 25, 2026
• Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
• Component: "Mask" (mask)
• Composer Package Name: mask/mask
• Vulnerability Type: Path Traversal
• Affected Versions: 8.3.11 and below, 9.0.0 - 9.0.10
• Severity: Medium
• Suggested CVSS v4.0: AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
• References: CVE-2026-77139, CWE-22, CWE-73

Problem Description

The extension fails to validate a client-supplied template element key before using it to build file paths for saving and deleting Mask template files. An authenticated backend user with access to the Mask module can supply a key containing path traversal sequences to create or delete .html files outside the configured template directory.

Solution

Updated versions 8.3.12 and 9.0.11 are available from the TYPO3 extension manager, packagist and at

https://extensions.typo3.org/extension/download/mask/8.3.12/zip
https://extensions.typo3.org/extension/download/mask/9.0.11/zip

Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Seungbin Yang and Christian Kuhn for reporting the vulnerability, and to Nikita Hovratov for providing updated versions of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.