CVE-2026-47346: TYPO3 CMS - Broken Access Control in Form Framework

Synopsis

Broken access control in TYPO3 CMS allows authenticated backend users to bypass file upload restrictions in the Form Framework by uploading form definition files with mixed-case extensions (e.g., .FORM.YAML). The vulnerability is reachable over the network and requires only a low-privilege backend account with file write permissions, with no victim interaction needed. Successful exploitation lets an attacker execute arbitrary SQL statements against the database, enabling full privilege escalation by creating new administrative backend accounts. Patched-image rebuilds at versions 10.4.57, 11.5.51, 12.4.46, 13.4.31, and 14.3.3 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the TYPO3 backend over the network; the vulnerable upload endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege backend account with file write permissions is sufficient; no administrative role is needed to initiate the attack.

• Victim interactionNot required

  No victim interaction is needed; the attacker uploads the malicious file and triggers execution entirely on their own.

• Attack complexityDetail

  Base exploit logic is condition-free and reliable, though the CVSS v4.0 vector notes an attack requirement of partial (AT:P), meaning the attacker must have the file write permission already granted to their account.

Blast Radius

• Attacker executes arbitrary SQL statements against the TYPO3 database backend.
• Attacker creates new administrative backend user accounts, achieving full privilege escalation.
• Attacker gains read and write access to all data stored in the TYPO3 database, including user credentials, content records, and configuration.
• Availability of the service is not directly impacted by this vulnerability based on the CVSS impact tokens.