---
id: CVE-2026-49133
title: 'Typemill < 2.24.0 Path Traversal via ControllerApiImage::getPagemedia()'
summary: >-
  Typemill before 2.24.0 contains a path traversal vulnerability that allows
  authenticated attackers with Author-level privileges to read arbitrary files
  outside the content directory by supplying traversal sequences in the path
  query para…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-22
vendor: typemill
product: typemill
affected:
  - typemill < 2.24.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-06-18T12:56:08.627763Z'
published: '2026-06-17'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:04:44.761Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-49133'
references:
  - url: 'https://github.com/typemill/typemill/releases/tag/v2.24.2'
    label: typemill 2.24.2 Release Notes
  - url: >-
      https://github.com/typemill/typemill/commit/bfbb27001acd5c56ad62166dbefe6a59798cf1c0
  - url: >-
      https://www.vulncheck.com/advisories/typemill-path-traversal-via-controllerapiimage-getpagemedia
tags:
  - cve.org
epss: 0.00343
epssPercentile: 0.28022
ingestedAt: '2026-11-08T14:51:22.388Z'
---

## Overview

Typemill before 2.24.0 contains a path traversal vulnerability that allows authenticated attackers with Author-level privileges to read arbitrary files outside the content directory by supplying traversal sequences in the path query parameter passed to Storage::getFile() with an empty folder argument. Attackers can bypass traversal-prevention controls in Storage::getFolderPath() to access sensitive files.

## Affected

- `typemill < 2.24.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.