SecurityTYPO3 CMS

TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework

13 October 2026

It has been discovered that TYPO3 CMS is susceptible to ignored upload storage configuration in the Form Framework.

Elias Häußler

Component Type: TYPO3 CMS
Subcomponent: Form Framework (ext:form)
Release Date: October 13, 2026
Vulnerability Type: Security Misconfiguration
Affected Versions: 14.0.0-14.3.8
Severity: Medium
Suggested CVSS: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
References: CVE-2026-109162, CWE-696, CWE-552

Problem Description

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected.

Solution

Update to TYPO3 version 14.3.9 LTS that fixes the problem described.

Credits

Thanks to Bejo ning and Eurico Nicacio for reporting this issue, and to Josua Vogel for fixing it.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.

General Note

All security-related code changes are tagged so you can easily look them up in our review system.

Share this article

About the Author

Elias Häußler

Backend Developer & Security Team Member

I’m a Backend Developer at coding. powerful. systems. CPS GmbH, specializing in PHP, TYPO3, and Open Source. My work focuses on building high-performance systems and automating processes in development and DevOps. I emphasize code quality, testing, and continuous improvement to create scalable, maintainable, and sustainable solutions.

I’m also pursuing a Master’s degree in Cyber- & IT-Security at Digital Business University of Applied Sciences, driven by my interest in integrating security practices early in the development lifecycle without compromising productivity.

As a member of the TYPO3 Security Team, I contribute to vulnerability analysis and remediation—bridging my professional development work with my academic focus on IT security.

Additionally, I maintain several Open Source projects, mainly TYPO3 extensions such as EXT:warming (cache warmup) and EXT:solver (AI-assisted error analysis).