CVE-2026-47346 — TYPO3 CMS has Broken Access Control in...

HIGH

TYPO3 CMS has Broken Access Control in its Form Framework

Published June 12, 2026Updated September 10, 2026Source: osv

Summary

### Problem Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., `.FORM.YAML`) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks Alexander Künzl for reporting this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke for fixing it. ### Resources * [TYPO3-CORE-SA-2026-008](https://typo3.org/security/advisory/typo3-core-sa-2026-008)

Advisory Timeline

First published June 12, 2026 (122 days ago).
Last revised September 10, 2026 — 89 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Composer

Update typo3/cms-form to 12.4.46 or later

composer require "typo3/cms-form:^12.4.46"

Composer

Update typo3/cms-form to 13.4.31 or later

composer require "typo3/cms-form:^13.4.31"

Composer

Update typo3/cms-form to 14.3.3 or later

composer require "typo3/cms-form:^14.3.3"

Composer

Update typo3/cms-form to 10.4.57 or later

composer require "typo3/cms-form:^10.4.57"

Composer

Update typo3/cms-core to 13.4.31 or later

composer require "typo3/cms-core:^13.4.31"

Composer

Update typo3/cms-form to 11.5.51 or later

composer require "typo3/cms-form:^11.5.51"

Composer

Update typo3/cms-core to 11.5.51 or later

composer require "typo3/cms-core:^11.5.51"

Composer

Update typo3/cms-core to 12.4.46 or later

composer require "typo3/cms-core:^12.4.46"

Composer

Update typo3/cms-core to 10.4.57 or later

composer require "typo3/cms-core:^10.4.57"

Composer

Update typo3/cms-core to 14.3.3 or later

composer require "typo3/cms-core:^14.3.3"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (10)

Affects 1 ecosystem: packagist (2).

Package	Ecosystem	Affected	Fixed In
typo3/cms-form	packagist	v12.0.0, v12.1.0, v12.1.1, v12.1.2 (+49 more)	12.4.46
typo3/cms-form	packagist	v13.0.0, v13.0.1, v13.1.0, v13.1.1 (+34 more)	13.4.31
typo3/cms-form	packagist	v14.0.0, v14.0.1, v14.0.2, v14.1.0 (+5 more)	14.3.3
typo3/cms-form	packagist	v10.0.0, v10.1.0, v10.2.0, v10.2.1 (+106 more)	10.4.57
typo3/cms-core	packagist	v13.0.0, v13.0.1, v13.1.0, v13.1.1 (+35 more)	13.4.31
typo3/cms-form	packagist	v11.0.0, v11.1.0, v11.1.1, v11.2.0 (+47 more)	11.5.51
typo3/cms-core	packagist	v11.0.0, v11.1.0, v11.1.1, v11.2.0 (+47 more)	11.5.51
typo3/cms-core	packagist	v12.0.0, v12.1.0, v12.1.1, v12.1.2 (+49 more)	12.4.46
typo3/cms-core	packagist	v10.0.0, v10.1.0, v10.2.0, v10.2.1 (+106 more)	10.4.57
typo3/cms-core	packagist	v14.0.0, v14.0.1, v14.0.2, v14.1.0 (+5 more)	14.3.3

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-178
View on MITRE
CWE-862
Missing AuthorizationMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 7.7 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

—

Confidentiality

—

Integrity

—

Availability

—

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

Frequently Asked Questions

What is CVE-2026-47346?: TYPO3 CMS has Broken Access Control in its Form Framework This vulnerability has been assigned a severity rating of HIGH (CVSS score: 7.7/10).
How do I check if my project is affected by CVE-2026-47346?: CVE-2026-47346 affects typo3/cms-form and typo3/cms-core. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2026-47346 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

7.7

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-hwvq-2w67-rvxp

Related CVEs

CVE-2021-21355
HIGH
Unrestricted File Upload in Form Framework
CVE-2026-47343
HIGH
TYPO3 CMS: Destructive Actions on File Mount Folders
CVE-2026-49741
HIGH
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
CVE-2026-11607
HIGH
TYPO3 CMS has Broken Access Control in its Form Framework
CVE-2023-24814
HIGH
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
CVE-2026-0859
MEDIUM
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
CVE-2026-49740
MEDIUM
TYPO3 CMS has Insecure Deserialization via Core API
CVE-2018-14041
MEDIUM
Bootstrap Cross-site Scripting vulnerability

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies