Vulnerability advisory

CVE-2026-47343

TYPO3 CMS - Destructive Actions on File Mount Folders

Published Jun 9, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
fd8745e46bb11773e85524b8ee9650dabe340713 to before 59bfeaaf0136dfe17011786ce825884e48bedc8d	`59bfeaaf0136dfe17011786ce825884e48bedc8d`
6d6bd23afff6a48ee3efeaa68eb829820397d6a1 to before e16ec78165a7d60f09dcac04bfbb309409e174b3	`e16ec78165a7d60f09dcac04bfbb309409e174b3`
Not specified	`504e72470ff72aaf5d2256878bf473747f389798`
Not specified	`ac4125aef8b9b94528a7f74db2444db57b05a87b`
Also listed as affected (42) `v14.3.2` `v13.4.30` `v14.3.1` `v13.4.29` `v14.3.0` `v13.4.28` `v14.2.0` `v13.4.27` `v13.4.26` `v14.1.0` `v13.4.25` `v13.4.24` `v13.4.23` `v13.4.22` `v13.4.21` `v14.0.0` `v13.4.20` `v13.4.19` `v13.4.18` `v13.4.17` `v13.4.16` `v13.4.15` `v13.4.14` `v13.4.13` `v13.4.12` `v13.4.11` `v13.4.10` `v13.4.9` `v13.4.8` `v13.4.7` `v13.4.6` `v13.4.5` `v13.4.4` `v13.4.3` `v13.4.2` `v13.4.1` `v13.4.0` `v13.3.0` `v13.2.1` `v13.2.0` `v13.1.0` `v13.0.0`

Description

Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.

CVE-2026-47343

Affected versions

Repository

Description

References