Release Date: September 12, 2016
Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
Affected Versions: version 6.2.8 and below
Vulnerability Type: Arbitrary Code Execution
Problem Description: The extension provides the possibility to upload a profile image. The uploaded file is stored in a known directory without proper file type check. An attacker could upload PHP files, guess the name of the created file and therefore execute arbitrary code.
Solution: An updated version 6.2.9 is available from the TYPO3 Extension Manager and at https://typo3.org/extensions/repository/download/sf_register/6.2.9/t3x/. Users of the extension are advised to update the extension as soon as possible.
Credits: Thanks to Falk Huber who discovered and reported the issue.