TYPO3 CMS - Broken Access Control in Form Framework
CVE-2026-47346

7.6HIGH

Key Information:

Vendor

Typo3

Status
Typo3 Cms
Vendor
CVE Published:
9 June 2026

What is CVE-2026-47346?

Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

Affected Version(s)

TYPO3 CMS 0 < 10.4.57

TYPO3 CMS 11.0.0 < 11.5.51

TYPO3 CMS 12.0.0 < 12.4.46

References

https://typo3.org/security/advisory/typo3-core-sa-2026-008
vendor-advisory
https://github.com/TYPO3/typo3/commit/2030617e6f273cee7b7...
patch
https://github.com/TYPO3/typo3/commit/eb2b2251d90339d3ab5...
patch

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alexander Künzl
Oliver Hader
Benjamin Franzke
.