Vulnerability · Published Jun 9, 2026 · Assigned by TYPO3

CVE-2026-47343TYPO3 CMS - Destructive Actions on File Mount Folders

High 7.2

In plain English

A high-severity missing authorization in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.2High

Exploit odds (30 days)0.2%top 85.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	typo3/cms-core	10.4.57	GHSA-3v8v-4wg6-r7qh
Packagist	typo3/cms-core	11.5.51	GHSA-3v8v-4wg6-r7qh
Packagist	typo3/cms-core	12.4.46	GHSA-3v8v-4wg6-r7qh
Packagist	typo3/cms-core	13.4.31	GHSA-3v8v-4wg6-r7qh
Packagist	typo3/cms-core	14.3.3	GHSA-3v8v-4wg6-r7qh

Affected products (as reported)

Vendor	Product	Versions
TYPO3	TYPO3 CMS	0 – before 10.4.5711.0.0 – before 11.5.5112.0.0 – before 12.4.4613.0.0 – before 13.4.3114.0.0 – before 14.3.3

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-core-sa-2026-007 vendor-advisory
Git commit of main branch patch
Git commit of 13.4 branch patch