CVE-2026-109162 TYPO3 CVE debrief

Who should care

TYPO3 CMS administrators, security teams, and developers responsible for configuring and maintaining TYPO3 CMS installations. These stakeholders should assess exposure, review configurations for custom saveToFileMount settings, and update to version 14.3.9 or later to mitigate this issue.

Why it matters

A security misconfiguration in TYPO3 CMS Form Framework could cause uploaded files to be stored in a publicly accessible storage folder, potentially bypassing intended access restrictions. TYPO3 CMS administrators and security teams should assess exposure and update to version 14.3.9 or later.

• Potential unauthorized access to uploaded files
• Bypassing of intended access restrictions for non-public storages
• Need for verification of custom saveToFileMount configurations
• Potential exposure of sensitive information in uploaded files

Technical summary

The TYPO3 CMS Form Framework has a security misconfiguration that causes uploaded files to be stored in a publicly accessible storage folder when using FileUpload or ImageUpload elements with a custom saveToFileMount configured. This issue affects TYPO3 CMS versions 14.0.0-14.3.8. The vulnerability arises from a misconfiguration in the Form Framework's handling of FileUpload and ImageUpload elements, leading to potential unauthorized access to uploaded files. Files stored in this manner are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected.

Defensive priority

Medium priority for TYPO3 CMS administrators and security teams

Recommended defensive actions

• Review and update TYPO3 CMS to version 14.3.9 or later
• Verify configurations for custom saveToFileMount settings
• Assess exposure of uploaded files in publicly accessible storage folders
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the security misconfiguration in TYPO3 CMS Form Framework. The issue allows uploaded files to be stored in a publicly accessible storage folder, potentially bypassing access restrictions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.