EUVD-2026-35393
GHSA-hwvq-2w67-rvxp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconAuthenticate to TYPO3 backend with editor credentials
-
DeliveryCraft form YAML with malicious SQL finisher
-
ExploitUpload as .FORM.YAML bypassing case-sensitive suffix check
-
InstallTrigger form definition parsing
-
C2Execute arbitrary SQL inserting be_users admin row
-
ExecuteLog in as new administrator
-
ImpactFull CMS takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Case sensitivity handling
|
| Exploitation Conditions | Attacker must hold an authenticated TYPO3 backend account (PR:L confirmed in CVSS vector) that has been granted the 'file write' permission within the TYPO3 backend user/group configuration - anonymous frontend visitors cannot reach this code path. The target TYPO3 installation must be hosted on a case-insensitive filesystem (Windows NTFS, default macOS APFS/HFS+, or SMB-mounted storage); installations on standard Linux ext4/xfs are not exploitable via this exact bypass because the case-sensitive filename is preserved end-to-end. The Form Framework system extension (EXT:form) must be installed and active, which is the default for TYPO3 Core. No user interaction by another victim is required (UI:N). |
| Impact | CVSS 4.0 vector reports AV:N/AC:L/AT:P/PR:L/UI:N with high confidentiality and integrity impact (VC:H/VI:H), reflecting that an attacker must already hold low-privileged backend credentials (PR:L) with the specific 'file write' permission, and that an attack requirement (AT:P) - a case-insensitive filesystem such as Windows NTFS or macOS HFS+ default - must be present. EPSS and CISA KEV signals were not provided in the input; no public exploit identified at time of analysis. The realistic risk is moderate-to-high for organizations running TYPO3 on Windows/macOS hosts or shared-hosting setups where editor-tier accounts are routinely granted file-write rights, because the path from low-privileged user to administrative account creation is short and the patch commit publicly shows the exact bypass mechanism. Risk is lower for Linux-hosted instances on case-sensitive ext4/xfs filesystems where the precondition does not hold; defenders should verify their storage configuration before deprioritizing. |
| Exploit ScenarioDerived | An attacker who has phished or otherwise obtained credentials for a low-privileged TYPO3 backend editor account with file-write permission logs into the backend on a TYPO3 instance hosted on Windows or macOS. They upload a malicious form definition named 'pwn.FORM.YAML' containing a database finisher with crafted SQL; the case-insensitive bypass lets the file past the FilePersistenceSlot guard, and when the form is invoked or processed, the embedded SQL runs and inserts a new be_users row with admin=1, granting full administrative control of the CMS. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 09, 2026
Privilege escalation in TYPO3 CMS Form Framework allows authenticated backend users with file write permissions to bypass upload restrictions using mixed-case file extensions (e.g., .FORM.YAML), then execute arbitrary SQL via crafted form definition files to create administrative backend accounts. The flaw affects TYPO3 versions before 10.4.57, 11.5.50, 12.4.45, 13.4.30, and 14.3.2 across all supported branches. No public exploit identified at time of analysis, but the upstream fix is published with detailed commit-level test cases that effectively serve as a roadmap for exploit development.
RemediationAI
Vendor-released patches: upgrade to TYPO3 10.4.57, 11.5.50, 12.4.45, 13.4.30, or 14.3.2 (or later) depending on your supported branch, as documented in advisory https://typo3.org/security/advisory/typo3-core-sa-2026-008 with the upstream fixes at GitHub commits 2030617e6f273cee7b756c695f0a48a45a31eb47 and eb2b2251d90339d3ab55df3d4c0378ae0c780b45. As an interim compensating control, audit backend user groups and revoke the 'file write' permission from any non-administrative editor accounts that do not strictly need it - this directly removes the prerequisite (PR:L plus file upload right) for exploitation but will block legitimate content editors from uploading assets until restored. Additionally, hosts running TYPO3 on case-insensitive filesystems (Windows, default macOS) are the realistic attack surface; where feasible, migrate the fileadmin storage to a case-sensitive Linux filesystem to neutralize the bypass, accepting that this is a non-trivial infrastructure change. At the web layer, configure the reverse proxy or WAF to reject backend upload requests whose filename matches case-insensitive '.form.yaml' patterns ('\.form\.ya?ml$' with the 'i' flag), recognizing this is a brittle stopgap that may block legitimate form-editor uploads.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 3 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
TYPO3 CMS is a widely deployed PHP-based enterprise content management system. The vulnerability is rooted in CWE-178 (Improper Handling of Case Sensitivity), specifically in the Form Framework's FilePersistenceSlot.php, which used a case-sensitive str_ends_with() check against the lowercase '.form.yaml' extension to gate dangerous form-definition uploads. On case-insensitive filesystems, an attacker could upload a file named with mixed-case (e.g., '.FORM.YAML') that bypassed the protection check but was still parsed as a YAML form definition by downstream handlers. Because TYPO3's Form Framework allows form definitions to declare database finishers and finisher options, attacker-controlled YAML translates into arbitrary SQL execution against the TYPO3 database. The upstream patch normalizes the identifier with mb_strtolower() before the suffix check in FilePersistenceSlot.php, and also lowercases filenames in LocalDriver.php sanitizeFileName() when the underlying filesystem is case-insensitive.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Primary rating from Vendor (f4fb688c-4412-4426-b4b8-421ecf27b14a) · only source for this CVE.
CVSS VectorVendor: f4fb688c-4412-4426-b4b8-421ecf27b14a
Lifecycle Timeline
1DescriptionCVE.org
Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.
Executive ViewAI
TYPO3 CMS Form Framework contains a privilege escalation vulnerability affecting all supported versions, permitting authenticated backend users with file-write access to create unauthorized administrative accounts. Although no public exploit has been identified, interim access controls are critical pending formal vendor patch releases to mitigate the risk of credential hijacking and system compromise.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict file write permissions to users with documented business requirement and audit regularly; (2) Implement role-based access controls limiting Form Framework functionality; (3) Enable audit logging and alerting for form file modifications and administrative account creation; (4) Disable the TYPO3 Form Framework extension if unused; (5) Isolate affected TYPO3 instances or restrict network access where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB