~ / search / GHSA-hwvq-2w67-rvxp

GHSA-hwvq-2w67-rvxp

TYPO3 CMS has Broken Access Control in its Form Framework

Source: GitHub Advisory Database (reviewed) High CVE-2026-47346

Packages

EcosystemPackageAffectedFixed in
Packagist typo3/cms-core < 10.4.57 10.4.57
Packagist typo3/cms-core >= 11.0.0, < 11.5.51 11.5.51
Packagist typo3/cms-core >= 12.0.0, < 12.4.46 12.4.46
Packagist typo3/cms-core >= 13.0.0, < 13.4.31 13.4.31
Packagist typo3/cms-core >= 14.0.0, < 14.3.3 14.3.3
Packagist typo3/cms-form < 10.4.57 10.4.57
Packagist typo3/cms-form >= 11.0.0, < 11.5.51 11.5.51
Packagist typo3/cms-form >= 12.0.0, < 12.4.46 12.4.46
Packagist typo3/cms-form >= 13.0.0, < 13.4.31 13.4.31
Packagist typo3/cms-form >= 14.0.0, < 14.3.3 14.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Problem Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., `.FORM.YAML`) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks Alexander Künzl for reporting this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke for fixing it. ### Resources * [TYPO3-CORE-SA-2026-008](https://typo3.org/security/advisory/typo3-core-sa-2026-008)

References

External links from the advisory. They lead to third-party sites.