CVE-2026-109162
TYPO3 CMS - Security Misconfiguration in Form Framework
TYPO3 TYPO3 CMSApplications & CMS
CVSS
6.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.51%Chance of exploitation activity in the next 30 days, higher than 42% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 14.3.9TYPO3 CMSCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.
Text from CVE List
Affected versions 1
- TYPO3 CMSaffected: 14.0.0 before 14.3.9CVE List