PatchSiren cyber security CVE debrief
CVE-2026-49133 typemill CVE debrief
CVE-2026-49133 is a high-severity path traversal vulnerability in Typemill before 2.24.0. Authenticated attackers with Author-level privileges can read arbitrary files outside the content directory by manipulating the path query parameter. This vulnerability, with a CVSS score of 7.1, was publicly disclosed on June 17, 2026. The vulnerability was patched in version 2.24.2. Users should update to the latest version to mitigate this risk.
- Vendor
- typemill
- Product
- Unknown
- CVSS
- HIGH 7.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-17
- Original CVE updated
- 2026-06-23
- Advisory published
- 2026-06-17
- Advisory updated
- 2026-06-23
Who should care
Administrators and users of Typemill versions prior to 2.24.0 should be aware of this vulnerability. Specifically, those with Author-level privileges are at risk of being exploited. Additionally, security teams and IT professionals responsible for maintaining Typemill installations should prioritize patching to prevent potential data breaches.
Technical summary
The vulnerability exists in the Storage::getFile() method of Typemill, where an empty folder argument allows attackers to bypass traversal-prevention controls in Storage::getFolderPath(). By supplying traversal sequences in the path query parameter, attackers can access sensitive files outside the content directory. The CVSS vector for this vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.
Defensive priority
High
Recommended defensive actions
- Update Typemill to version 2.24.2 or later
- Restrict Author-level privileges to minimize risk
- Monitor for suspicious file access attempts
- Implement additional access controls and file system restrictions
- Regularly review and update software dependencies
- Consider using a Web Application Firewall (WAF) to detect and prevent attacks
- Perform a thorough security audit of the Typemill installation
Evidence notes
The vulnerability was publicly disclosed on June 17, 2026, and patched in version 2.24.2. The CVE record and NVD detail provide additional information on the vulnerability. References to the disclosure and patch can be found at [ref-4], [ref-5], and [ref-6].
Official resources
CVE-2026-49133 was publicly disclosed on June 17, 2026.