--- title: "TYPO3-CORE-SA-2018-003: Privilege Escalation & SQL Injection in TYPO3 CMS" url: "https://news.typo3.com/security/advisory/typo3-core-sa-2018-003" description: It has been discovered, that TYPO3 CMS is vulnerable to Privilege Escalation and SQL Injection. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - TYPO3 CMS --- # TYPO3-CORE-SA-2018-003: Privilege Escalation & SQL Injection in TYPO3 CMS - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [TYPO3 CMS](https://news.typo3.com/article/category/security/typo3-cms) TYPO3-CORE-SA-2018-003: Privilege Escalation & SQL Injection in TYPO3 CMS ============================================================================= 12 July 2018 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered, that TYPO3 CMS is vulnerable to Privilege Escalation and SQL Injection. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b8266fdc667b773926c59081862ab148.jpeg)[Oliver Hader](https://news.typo3.com/article/author/oliver-hader) - **Component Type:** TYPO3 CMS - **Vulnerable subcomponent:** Form Framework (ext:form) - **Release Date:** July 12, 2018 - **Vulnerability Type:** Privilege Escalation & SQL Injection - **Affected Versions:** 8.5.0 to 8.7.16 and 9.0.0 to 9.3.0 - **Severity:** High - **Suggested CVSS v2.0:** [AV:N/AC:M/Au:S/C:C/I:C/A:C/E:H/RL:OF/RC:C](https://nvd.nist.gov/vuln-metrics/cvss/v2-calculator?vector=(AV:N/AC:M/Au:S/C:C/I:C/A:C/E:H/RL:OF/RC:C)) - **CVE:** not assigned yet ### Problem Description Failing to properly dissociate system related configuration from user generated configuration, the Form Framework (system extension "form") is vulnerable to SQL injection and Privilege Escalation. Basically instructions can be persisted to a form definition file that were not configured to be modified - this applies to definitions managed using the form editor module as well as direct file upload using the regular file list module. A valid backend user account as well as having system extension form activated are needed in order to exploit this vulnerability. ### Solution Update to TYPO3 versions 8.7.17 or 9.3.1 that fix the problem described. In order to distinguish form definitions files from regular YAML files, the new file suffix “.form.yaml” has been introduced. According form definition files have to be renamed to use the new file suffix (e.g. “Contact.yaml” has to become “Contact.form.yaml”) - this applies to files provided by TYPO3 extensions as well. A new upgrade wizard renames affected resources in storages managed by the file abstraction layer (FAL) and updates references in content elements as well. ### Suggested migration path - ensure reference index is up-to-date (see [documentation](https://docs.typo3.org/typo3cms/InstallationGuide/Upgrade/UpdateReferenceIndex/Index.html)) - update to mentioned TYPO3 versions in order to fix the problem described - rename form definition files in extensions manually to use the “.form.yaml” suffix (files just having the “.yaml” suffix still can be referenced and rendered in the website frontend) - execute “Rename form definition file extension from .yaml to .form.yaml” upgrade wizard in the TYPO3 install tool ### Credits Thanks to TYPO3 core team member Oliver Hader  who reported this issue and to TYPO3 core team members Susanne Moog & Ralf Zimmermann who fixed the issue. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/SecurityGuide/). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ### General Note All security related code changes are tagged so that you can easily look them up in our [review system](https://review.typo3.org/#/q/status:merged+project:Packages/TYPO3.CMS+topic:security,n,z). ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/cc7cba9757f98fbe05023a139119df74.jpeg) About the Author [Oliver Hader](https://news.typo3.com/article/author/oliver-hader) Core Developer at TYPO3 GmbH,Hof, Germany [Website](https://typo3.com)[Twitter](https://twitter.com/ohader)[LinkedIn](https://www.linkedin.com/in/oliverhader/)[Xing](https://www.xing.com/profile/Oliver_Hader) Oliver started to work with TYPO3 in 2005 and was fascinated by the product and its universe. Since 2007 he is member of the TYPO3 Core Team. After going back to university in 2014 for achieving a postgraduate master degree in internet web science, he is now researching on advanced web technology topics in general and for TYPO3 in particular. In his spare time, Oliver loves to go cycling cross-country in the uplands around Hof (Germany) in northern Bavaria - at the region where he's living as well. [More posts by this author](https://news.typo3.com/article/author/oliver-hader)