{"api_version":"1","generated_at":"2026-06-22T19:30:02+00:00","cve":"CVE-2026-47346","urls":{"html":"https://cve.report/CVE-2026-47346","api":"https://cve.report/api/cve/CVE-2026-47346.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-47346","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-47346"},"summary":{"title":"TYPO3 CMS - Broken Access Control in Form Framework","description":"Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.","state":"PUBLISHED","assigner":"TYPO3","published_at":"2026-06-09 11:16:52","updated_at":"2026-06-09 13:46:50"},"problem_types":["CWE-178","CWE-862","CWE-178 CWE-178 Improper Handling of Case Sensitivity","CWE-862 CWE-862 Missing Authorization"],"metrics":[{"version":"4.0","source":"f4fb688c-4412-4426-b4b8-421ecf27b14a","type":"Secondary","score":"7.6","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","data":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}},{"version":"4.0","source":"CNA","type":"CVSS","score":"7.6","severity":"HIGH","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","data":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.6,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"}}],"references":[{"url":"https://typo3.org/security/advisory/typo3-core-sa-2026-008","name":"https://typo3.org/security/advisory/typo3-core-sa-2026-008","refsource":"f4fb688c-4412-4426-b4b8-421ecf27b14a","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/TYPO3/typo3/commit/eb2b2251d90339d3ab55df3d4c0378ae0c780b45","name":"https://github.com/TYPO3/typo3/commit/eb2b2251d90339d3ab55df3d4c0378ae0c780b45","refsource":"f4fb688c-4412-4426-b4b8-421ecf27b14a","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/TYPO3/typo3/commit/2030617e6f273cee7b756c695f0a48a45a31eb47","name":"https://github.com/TYPO3/typo3/commit/2030617e6f273cee7b756c695f0a48a45a31eb47","refsource":"f4fb688c-4412-4426-b4b8-421ecf27b14a","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-47346","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-47346","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"TYPO3","product":"TYPO3 CMS","version":"affected 10.4.57 semver","platforms":[]},{"source":"CNA","vendor":"TYPO3","product":"TYPO3 CMS","version":"affected 11.0.0 11.5.51 semver","platforms":[]},{"source":"CNA","vendor":"TYPO3","product":"TYPO3 CMS","version":"affected 12.0.0 12.4.46 semver","platforms":[]},{"source":"CNA","vendor":"TYPO3","product":"TYPO3 CMS","version":"affected 13.0.0 13.4.31 semver","platforms":[]},{"source":"CNA","vendor":"TYPO3","product":"TYPO3 CMS","version":"affected 14.0.0 14.3.3 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Alexander Künzl","lang":"en"},{"source":"CNA","value":"Oliver Hader","lang":"en"},{"source":"CNA","value":"Benjamin Franzke","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"47346","cve":"CVE-2026-47346","epss":"0.004390000","percentile":"0.348260000","score_date":"2026-06-16","updated_at":"2026-06-17 00:05:46"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-47346","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-06-09T12:51:14.282222Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-06-09T12:52:49.295Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"collectionURL":"https://packagist.org","defaultStatus":"unaffected","modules":["Form"],"packageName":"typo3/cms-core","product":"TYPO3 CMS","repo":"https://github.com/TYPO3/typo3","vendor":"TYPO3","versions":[{"lessThan":"10.4.57","status":"affected","version":"0","versionType":"semver"},{"lessThan":"11.5.51","status":"affected","version":"11.0.0","versionType":"semver"},{"lessThan":"12.4.46","status":"affected","version":"12.0.0","versionType":"semver"},{"lessThan":"13.4.31","status":"affected","version":"13.0.0","versionType":"semver"},{"lessThan":"14.3.3","status":"affected","version":"14.0.0","versionType":"semver"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","versionEndExcluding":"10.4.57","vulnerable":true},{"criteria":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","versionEndExcluding":"11.5.51","versionStartIncluding":"11.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","versionEndExcluding":"12.4.46","versionStartIncluding":"12.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","versionEndExcluding":"13.4.31","versionStartIncluding":"13.0.0","vulnerable":true},{"criteria":"cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*","versionEndExcluding":"14.3.3","versionStartIncluding":"14.0.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"credits":[{"lang":"en","type":"reporter","value":"Alexander Künzl"},{"lang":"en","type":"remediation developer","value":"Oliver Hader"},{"lang":"en","type":"remediation developer","value":"Benjamin Franzke"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., <code>.FORM.YAML</code>) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2."}],"value":"Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2."}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":7.6,"baseSeverity":"HIGH","exploitMaturity":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-178","description":"CWE-178 Improper Handling of Case Sensitivity","lang":"en","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-862","description":"CWE-862 Missing Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-06-09T10:50:21.934Z","orgId":"f4fb688c-4412-4426-b4b8-421ecf27b14a","shortName":"TYPO3"},"references":[{"tags":["vendor-advisory"],"url":"https://typo3.org/security/advisory/typo3-core-sa-2026-008"},{"name":"Git commit of main branch","tags":["patch"],"url":"https://github.com/TYPO3/typo3/commit/2030617e6f273cee7b756c695f0a48a45a31eb47"},{"name":"Git commit of 13.4 branch","tags":["patch"],"url":"https://github.com/TYPO3/typo3/commit/eb2b2251d90339d3ab55df3d4c0378ae0c780b45"}],"source":{"discovery":"UNKNOWN"},"title":"TYPO3 CMS - Broken Access Control in Form Framework","x_generator":{"engine":"Vulnogram 1.0.1"}}},"cveMetadata":{"assignerOrgId":"f4fb688c-4412-4426-b4b8-421ecf27b14a","assignerShortName":"TYPO3","cveId":"CVE-2026-47346","datePublished":"2026-06-09T10:50:21.934Z","dateReserved":"2026-05-19T12:49:25.966Z","dateUpdated":"2026-06-09T12:52:49.295Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-06-09 11:16:52","lastModifiedDate":"2026-06-09 13:46:50","problem_types":["CWE-178","CWE-862","CWE-178 CWE-178 Improper Handling of Case Sensitivity","CWE-862 CWE-862 Missing Authorization"],"metrics":{"cvssMetricV40":[{"source":"f4fb688c-4412-4426-b4b8-421ecf27b14a","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"LOW","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"47346","Ordinal":"1","Title":"TYPO3 CMS - Broken Access Control in Form Framework","CVE":"CVE-2026-47346","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"47346","Ordinal":"1","NoteData":"Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30 and 14.0.0-14.3.2.","Type":"Description","Title":"TYPO3 CMS - Broken Access Control in Form Framework"}]}}}