TYPO3 CMS CVE-2026-11607

Attacker must hold an authenticated TYPO3 backend account that has been granted access to the Form Framework module and write access to a form definition storage location (typically a fileadmin subfolder configured for form_definitions). Exploitation further requires the ability to upload or create files with arbitrary extensions in that location and that the target site runs an unpatched version in the affected ranges (TYPO3 <10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31, 14.0.0-14.3.3). Limiting factors: no unauthenticated path exists, the Form Framework extension must be installed and active, and the editor's filemount permissions must permit writes to a directory the Form Framework will read.

CVSS 4.0 vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N indicates network-reachable, low-complexity exploitation but requires Attack Requirements (AT:P - a present prerequisite, here the Form Framework being accessible to the backend user) and low-privileged authentication (PR:L). High confidentiality and integrity impact reflects the SQL execution and resulting admin account creation; no availability impact is expected. EPSS and KEV data were not provided in the input, so probabilistic exploitation likelihood is unknown - however, the fix is already publicly visible on GitHub, which lowers the bar for exploit development. Real-world risk is meaningful but bounded: an attacker must already hold a backend account with Form Framework rights, so this is primarily a privilege-escalation path for compromised low-tier editors or malicious insiders rather than an unauthenticated internet-facing RCE. The 'Authentication Bypass' tag in the input is slightly misleading - this is post-authentication privilege escalation, not pre-auth bypass.

A low-privileged TYPO3 backend editor with access to the Form Framework uploads a crafted YAML file using an extension other than .form.yaml (for example, evil.yaml) into a form storage path. When the Form Framework loads this file, its contents are processed as a form definition despite the wrong extension, and embedded payload data causes arbitrary SQL statements to execute against the TYPO3 database, including INSERT statements that create a new entry in be_users with admin=1, granting the attacker full backend administrative access.