File Storage Misconfiguration in TYPO3 CMS by TYPO3
CVE-2026-109162

6.3MEDIUM

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109162?

TYPO3 CMS suffers from a misconfiguration issue where uploaded files using FileUpload or ImageUpload elements are incorrectly stored in the publicly accessible default storage folder rather than the intended destination. This vulnerability is particularly concerning as it allows files meant for restricted access to be publicly accessible, exposing sensitive information unintentionally. Forms utilizing the default saveToFileMount configuration are exempt from this issue, emphasizing that only custom configurations are affected. The versions vulnerable to this issue include TYPO3 CMS from 14.0.0 to 14.3.8.

Affected Version(s)

TYPO3 CMS 14.0.0 < 14.3.9

References

https://news.typo3.com/security/advisory/typo3-core-sa-20...
vendor-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bejo ning
Eurico Nicacio
Josua Vogel
.