EUVD-2026-35391
GHSA-pjpj-v387-x4vq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.51, 12.0.0-12.4.46, 13.0.0-13.4.31 and 14.0.0-14.3.3.
AnalysisAI
Privilege escalation in TYPO3 CMS allows authenticated backend users with Form Framework access to execute arbitrary SQL by uploading malicious form definitions with non-standard file extensions, enabling creation of administrative backend accounts. The flaw stems from incomplete file-extension validation in FormPersistenceManager and affects every supported branch (10.4, 11.5, 12.4, 13.4, 14.3) below the fixed releases. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must hold an authenticated TYPO3 backend account that has been granted access to the Form Framework module and write access to a form definition storage location (typically a fileadmin subfolder configured for form_definitions). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.0 vector AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N indicates network-reachable, low-complexity exploitation but requires Attack Requirements (AT:P - a present prerequisite, here the Form Framework being accessible to the backend user) and low-privileged authentication (PR:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged TYPO3 backend editor with access to the Form Framework uploads a crafted YAML file using an extension other than .form.yaml (for example, evil.yaml) into a form storage path. When the Form Framework loads this file, its contents are processed as a form definition despite the wrong extension, and embedded payload data causes arbitrary SQL statements to execute against the TYPO3 database, including INSERT statements that create a new entry in be_users with admin=1, granting the attacker full backend administrative access. |
| Remediation | Vendor-released patches are available: upgrade to TYPO3 10.4.57, 11.5.52, 12.4.47, 13.4.32, or 14.3.4 depending on the deployed branch, as published in advisory TYPO3-CORE-SA-2026-019 (https://typo3.org/security/advisory/typo3-core-sa-2026-019) and implemented in upstream commits 040d50d082a01f9e8bd113effd91290a9bb3b69e and 50974c658f647f1aece347b5d6d5acc3c87f2dca on GitHub. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit administrative accounts for unauthorized additions and review Form Framework access logs for suspicious form activities. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today