Vulnerability advisory

CVE-2026-47346

TYPO3 CMS - Broken Access Control in Form Framework

Published Jun 9, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
fd8745e46bb11773e85524b8ee9650dabe340713 to before 59bfeaaf0136dfe17011786ce825884e48bedc8d	`59bfeaaf0136dfe17011786ce825884e48bedc8d`
6d6bd23afff6a48ee3efeaa68eb829820397d6a1 to before e16ec78165a7d60f09dcac04bfbb309409e174b3	`e16ec78165a7d60f09dcac04bfbb309409e174b3`
Not specified	`2030617e6f273cee7b756c695f0a48a45a31eb47`
Not specified	`eb2b2251d90339d3ab55df3d4c0378ae0c780b45`
Also listed as affected (42) `v14.3.2` `v13.4.30` `v14.3.1` `v13.4.29` `v14.3.0` `v13.4.28` `v14.2.0` `v13.4.27` `v13.4.26` `v14.1.0` `v13.4.25` `v13.4.24` `v13.4.23` `v13.4.22` `v13.4.21` `v14.0.0` `v13.4.20` `v13.4.19` `v13.4.18` `v13.4.17` `v13.4.16` `v13.4.15` `v13.4.14` `v13.4.13` `v13.4.12` `v13.4.11` `v13.4.10` `v13.4.9` `v13.4.8` `v13.4.7` `v13.4.6` `v13.4.5` `v13.4.4` `v13.4.3` `v13.4.2` `v13.4.1` `v13.4.0` `v13.3.0` `v13.2.1` `v13.2.0` `v13.1.0` `v13.0.0`

Description

Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.

CVE-2026-47346

Affected versions

Repository

Description

References