Vulnerability · Published Oct 13, 2026 · Assigned by TYPO3

CVE-2026-109162TYPO3 CMS - Security Misconfiguration in Form Framework

Medium 6.3

In plain English

A medium-severity security flaw in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.

Affected products (as reported)

Vendor	Product	Versions
TYPO3	TYPO3 CMS	14.0.0 – before 14.3.9

Weakness: CWE-696, CWE-552 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://news.typo3.com/security/advisory/typo3-core-sa-2026-024 vendor-advisory
Git commit of main branch patch
Git commit of 14.3 branch patch