TYPO3 CMS EUVD-2026-35398

Exploitation requires an authenticated TYPO3 backend user account - confirmed by CVSS PR:L (low privileges required). The attacker must be able to reach the TYPO3 backend interface over the network (AV:N, AC:L). No special non-default configuration is required; the clipboard feature is enabled by default in all affected TYPO3 CMS versions. The key limiting factor is backend authentication: anonymous or frontend-only users cannot exploit this issue. Exploitation is further constrained to information disclosure of record/file metadata (existence, UID, path) rather than full content; and the attacker must have or guess valid record UIDs or file paths to reference. Organizations where all backend accounts belong to fully trusted staff face negligible risk; organizations with contractor, external, or semi-trusted backend users face meaningful insider-threat exposure.

The CVSS 4.0 score of 5.3 (Medium) accurately reflects a constrained real-world impact. The vector AV:N/AC:L/AT:N/PR:L/UI:N confirms network-reachable exploitation requiring only low privileges (an authenticated backend account), with low confidentiality impact and no integrity or availability impact. EPSS data was not provided in source intelligence, so exploitation probability cannot be quantified numerically. The issue is not listed in CISA KEV, and no POC code has been identified, indicating no confirmed or widespread active exploitation. The primary limiting factor is the requirement for an existing TYPO3 backend account - this is not an unauthenticated or pre-auth attack surface. Organizations with strict backend access controls (e.g., only trusted editors have backend accounts) face lower realistic risk than environments where backend access is broadly granted. The information disclosure is limited to record/file existence and metadata rather than full content exfiltration, further constraining the blast radius. Overall this is a genuine but moderate-priority finding: prioritize patching in environments with untrusted or semi-trusted backend users.

An attacker with a valid TYPO3 backend account - such as a low-privilege content editor - crafts clipboard insertion requests referencing record UIDs or file paths from tables and folders they are not authorized to access. By observing which clipboard entries are silently discarded versus retained and resolved by the unpatched cleanCurrent() method, the attacker can enumerate the existence and basic metadata of restricted records (e.g., unpublished pages, confidential file uploads) without holding read permissions on them. No public exploit code has been identified, but the technique requires only standard HTTP requests to the TYPO3 backend API and knowledge of target record UIDs or file paths.