CVE-2026-47343
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Non-privileged backend users were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.
Risk Assessment
The lack of proper authorization restrictions may lead to unauthorized changes in the file system, posing a risk of data loss or deletion of important folders.
Recommendation
It is recommended to update TYPO3 CMS to the latest version to mitigate this vulnerability and implement additional access controls for backend users.
Original NVD description (English source)
Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.