CVE-2026-49741
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Backend users with write access to the form_definition table can directly create, update, or delete form definitions via DataHandler, bypassing Form Framework validation and permission checks. This allows arbitrary form configurations, SQL injection, and privilege escalation.
Risk Assessment
An attacker can inject malicious forms, execute arbitrary SQL queries, and create admin accounts, leading to full compromise of the TYPO3 system.
Recommendation
Upgrade TYPO3 CMS to version 14.4.0 or later, which includes the fix.
Other vulnerabilities in TYPO3 CMS
See all- CVE-2026-6553High
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table. This issue affects TYPO3 CMS version 14.2.0.
- CVE-2026-0859High
A deserialization flaw in TYPO3's mail-file spool allows local users with write access to the spool directory to craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.
- CVE-2025-59022High
In TYPO3 CMS, backend users with access to the recycler module could delete arbitrary data from any database table defined in the TCA, regardless of their permissions to that table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22, and 14.0.0-14.0.1.
- CVE-2026-19418High
The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated from the backend or Install Tool itself was determined by comparing the referrer against the directory of the entry script, which since then is the site root. As a consequence, requests originating from any script running on one of the TYPO3 instance's own domains, such as a frontend page, were accepted by backend routes and Install Tool endpoints. Attackers able to execute JavaScript on one of those domains, for instance by exploiting a cross-site scripting vulnerability, could invoke these endpoints via Fetch/XHR with the privileges of an authenticated victim's user session. This issue affects TYPO3 CMS versions 13.0.0-13.4.33 and 14.0.0-14.3.5.
- CVE-2026-15305Medium
A vulnerability in TYPO3 CMS allows users to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.
- CVE-2026-49742High
Backend users with file download permissions can download files from the fallback storage of the file abstraction layer (FAL) via the Media Module, potentially exposing sensitive files like logs. Affects TYPO3 CMS versions 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.
- CVE-2026-49740Medium
TYPO3 CMS has a vulnerability in the cache frontend (VariableFrontend) and persistent key-value store (Registry) where PHP payloads are deserialized without integrity validation or class restrictions. An attacker with write access to the backend (e.g., SQL database) can inject a crafted payload leading to remote code execution.
- CVE-2026-49738Low
In TYPO3 CMS, the GeneralUtility::isAllowedAbsPath() function performed a plain string prefix comparison without requiring a directory separator boundary, allowing administrators with File Abstraction Layer access to create file storage definitions outside the project root.
- CVE-2026-47352Medium
Authenticated backend users could retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outside their permitted file mounts or storages. This affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
- CVE-2026-47351Medium
Backend users could insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, allowing them to gather information about records and files they were not authorized to view. This affects TYPO3 CMS versions 10.4.0-13.4.30 and 14.0.0-14.3.2.
Original NVD description (English source)
Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.