Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109162— TYPO3 CMS - Security Misconfiguration in Form Framework

Quick assessment

Affected
TYPO3 TYPO3 CMS
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

使用带有 自定义配置的 或 元素的表单，会将上传的文件存储到默认的存储文件夹 中，而不是配置的目标目录。这可能导致上传的文件被存放在公开可访问的存储中，即使已配置了受限的、非公开的存储。以这种方式存储的文件会直接被提供访问，而不应用针对非公开存储的安全访问检查。使用 默认值的表单不受此问题影响。 此漏洞影响 TYPO3 CMS 版本 14.0.0 至 14.3.8。

CVSS 6.3 · Medium

Possible ATT&CK Techniques 1 AI

T1565.001 · Stored Data Manipulation

Affected Version Matrix 1

VendorProduct Version RangeStatus
TYPO3 TYPO3 CMS 14.0.0< 14.3.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109162

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
TYPO3 CMS - Security Misconfiguration in Form Framework
Source: CVE Program / CVE List V5
Vulnerability Description
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不正确的行为次序
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
TYPO3 TYPO3 CMS 14.0.0 ~ 14.3.9 -

II. Public POCs for CVE-2026-109162

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109162

请登录查看更多情报信息。

Other References for CVE-2026-109162 (1)

IV. Related Vulnerabilities

Same product: TYPO3 CMS
Same vendor: TYPO3
Same weakness: CWE-696

V. Comments for CVE-2026-109162

No comments yet

Leave a comment