TYPO3 Core

If an editor pastes some HTML which contains an externally hosted image in an RTE field the HTML parser tries to download the image and store it in FAL.

\TYPO3\CMS\Core\Html\RteHtmlParser::TS_images_db()

It tries to store it in the default upload folder of the BE user and uses

$folder = $GLOBALS['BE_USER']->getDefaultUploadFolder($this->recPid, $table, $field);

to retrieve the folder object. This function may return false if no upload folder can be found.

The code fails to check for this condition and tries to create a file anyway, which results in a fatal error calling a function on a non-object.

$fileObject = $folder->createFile($fileName)->setContents($externalFile);