TYPO3 CMS CVE-2026-109162

Exploitation requires that a TYPO3 form include a FileUpload or ImageUpload element AND that it be configured with a custom (non-default) saveToFileMount pointing to a restricted, non-public storage - forms using the default saveToFileMount value are explicitly NOT affected. The flaw causes such uploads to be written to the public 1:/user_upload/ folder and served without the access checks normally applied to non-public storages. Realistic impact is further limited by whether sensitive files were actually uploaded to affected forms and whether an attacker can discover/enumerate the resulting public file paths; only TYPO3 CMS 14.0.0 through 14.3.8 are affected.

This is a moderate-severity information disclosure flaw (CVSS 4.0 base 6.3, vendor-assigned by TYPO3) in TYPO3 CMS. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N) indicates a network-reachable issue with no required privileges or user interaction, but the AT:P flag (attack requirements present) and the low confidentiality-only impact (VC:L) correctly signal that exploitation is not universal: it depends entirely on a non-default server-side misconfiguration and on sensitive files actually having been uploaded. No EPSS score, KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The underlying weakness (CWE-696, incorrect behavior order) is a logic error in how upload destinations are resolved, not a memory-corruption or RCE primitive - impact is limited to unintended public exposure of files meant for restricted storage. Net assessment: a genuine but lower-tier priority - patch it in the normal cycle, prioritizing instances that are known to use custom saveToFileMount on forms. Note a signal tension worth flagging: PR:N implies unauthenticated access, which is accurate for the attacker retrieving the mis-stored files, but the vulnerability only manifests when an administrator has configured a custom, non-public saveToFileMount - the real precondition is operator configuration, not attacker privilege.

A site administrator configures a TYPO3 form with a FileUpload or ImageUpload element pointing at a restricted, non-public saveToFileMount (e.g., for identity documents). Due to the flaw, submitted files are instead written to the default public 1:/user_upload/ folder and served directly without access checks. A remote unauthenticated attacker who can guess or enumerate the resulting file URLs retrieves the sensitive uploads. No public exploit code is identified at time of analysis.