{"id":"GHSA-p2jh-95jg-2w55","aliases":["BIT-typo3-2023-47126","CVE-2023-47126"],"title":"Information Disclosure in typo3/cms-install tool","description":"> ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (3.5)\n\n### Problem\nThe login screen of the standalone install tool discloses the full path of the transient data directory (e.g. _/var/www/html/var/transient/_). This applies to composer-based scenarios only - “classic” non-composer installations are not affected.\n\n### Solution\nUpdate to TYPO3 version 12.4.8 that fixes the problem described above.\n\n### Credits\nThanks to Markus Klein who reported and fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2023-005](https://typo3.org/security/advisory/typo3-core-sa-2023-005)\n","severity":"low","score":3.7,"published":"2023-11-14T20:34:26.000Z","modified":"2026-09-10T03:49:47.673Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"typo3/cms-install","ranges":[{"events":[{"introduced":"12.2.0"},{"fixed":"12.4.8"}],"type":"ECOSYSTEM"}],"versions":["v12.2.0","v12.3.0","v12.4.0","v12.4.1","v12.4.2","v12.4.3","v12.4.4","v12.4.5","v12.4.6","v12.4.7"],"fixed":["12.4.8"]}],"references":["https://github.com/TYPO3/typo3/security/advisories/GHSA-p2jh-95jg-2w55","https://nvd.nist.gov/vuln/detail/CVE-2023-47126","https://github.com/TYPO3/typo3/commit/1a735dac01ec7b337ed0d80c738caa8967dea423","https://github.com/TYPO3/typo3","https://typo3.org/security/advisory/typo3-core-sa-2023-005"],"sources":[{"name":"OSV","id":"GHSA-p2jh-95jg-2w55","modified":"2026-09-10T03:49:47.673498727Z","url":"https://osv.dev/vulnerability/GHSA-p2jh-95jg-2w55"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7}]}