CVE-2026-109162: TYPO3 CMS - Security Misconfiguration in Form Framework
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.
Affected Software
Event History
Frequently Asked Questions
Which TYPO3 forms are exposed to this issue?
Only forms using FileUpload or ImageUpload with a custom saveToFileMount configuration are affected. Forms that retain the default saveToFileMount value are not affected.
What does an attacker need to do to exploit the exposure?
An attacker needs to upload a file through an affected form. The file may then be stored in 1:/user_upload/ and served directly without the access checks intended for the configured non-public storage.
How can I determine whether my site may already be affected?
Review forms for FileUpload or ImageUpload elements configured with a custom saveToFileMount, then inspect 1:/user_upload/ for files uploaded through those forms. Affected behavior applies to TYPO3 CMS versions 14.0.0 through 14.3.8.
What can be done if updating is not immediately possible?
Avoid using custom saveToFileMount settings on FileUpload and ImageUpload form elements, or disable affected upload forms until they can be remediated. Verify that sensitive uploaded files are not present in the publicly accessible default storage folder.