CVE-2026-109162: TYPO3 CMS Information Disclosure Flaw

CVE-2026-109162 Overview

CVE-2026-109162 affects TYPO3 CMS versions 14.0.0 through 14.3.8. Forms that use FileUpload or ImageUpload elements with a custom saveToFileMount configuration stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. The flaw causes files intended for restricted, non-public storage to land in a publicly accessible location. Files stored this way are served directly, bypassing the access checks normally applied to non-public storages. Forms using the default saveToFileMount value are not affected. The vulnerability is tracked as a files-in-public-directory issue [CWE-552].

Critical Impact
Uploaded files that administrators believed were restricted become publicly accessible without authentication, enabling disclosure of sensitive user-submitted content.

Affected Products

TYPO3 CMS 14.0.0 through 14.3.8
Form framework (typo3/cms-form) with FileUpload elements
Form framework (typo3/cms-form) with ImageUpload elements

Discovery Timeline

2026-10-13 - CVE-2026-109162 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-109162

Vulnerability Analysis

The TYPO3 Form framework allows site integrators to specify a saveToFileMount property on FileUpload and ImageUpload form elements. This property defines the storage folder where submitted files are written. In affected versions, the property mapping and persistence logic did not propagate the configured mount into the file-writing routine. Instead, uploads fell back to the default storage, which is typically mapped to 1:/user_upload/ and served publicly through the web root.

The behavior defeats the intent of using a restricted storage. Administrators configure custom mounts specifically to apply access checks, authentication, or path-based restrictions. Because files land in the default public mount, those controls are never evaluated when a client requests the file.

Root Cause

The root cause is missing propagation of the saveToFileMount configuration between the Form MVC property-mapping layer and the FileUpload domain model. The upstream patches add imports for ResourceFactory, FolderDoesNotExistException, InsufficientFolderAccessPermissionsException, and PathUtility into PropertyMappingConfiguration.php and move the mount-resolution logic there, so the configured destination is honored before the file is persisted. This maps to [CWE-552]: Files or Directories Accessible to External Parties.

Attack Vector

An unauthenticated remote attacker submits a public TYPO3 form that includes a FileUpload or ImageUpload element configured with a custom saveToFileMount. The file is written to the default public storage and can then be retrieved directly over HTTP by guessing or enumerating the resulting URL under /fileadmin/user_upload/ (or the equivalent default mount path). No authentication or privilege is required to trigger the upload or retrieve the resulting file.

php

// Patch excerpt: typo3/sysext/form/Classes/Mvc/Property/PropertyMappingConfiguration.php
namespace TYPO3\CMS\Form\Mvc\Property;

use TYPO3\CMS\Core\Attribute\AsEventListener;
+use TYPO3\CMS\Core\Resource\Exception\FolderDoesNotExistException;
+use TYPO3\CMS\Core\Resource\Exception\InsufficientFolderAccessPermissionsException;
+use TYPO3\CMS\Core\Resource\ResourceFactory;
+use TYPO3\CMS\Core\Utility\PathUtility;
use TYPO3\CMS\Extbase\Persistence\ObjectStorage;
use TYPO3\CMS\Extbase\Validation\ValidatorResolver;
use TYPO3\CMS\Form\Domain\Model\FormElements\FileUpload;
// Source: https://github.com/TYPO3/typo3/commit/cc3e8e28b0e830aaf6ad857272f3f2dc3c4ede12

Detection Methods for CVE-2026-109162

Indicators of Compromise

Unexpected files present under the default storage path 1:/user_upload/ (typically served from /fileadmin/user_upload/) that correspond to form submissions configured for a different mount.
Web server access logs showing direct GET requests to files under /fileadmin/user_upload/ without an associated authentication or backend session.
TYPO3 form submission logs referencing a custom saveToFileMount while the resulting file reference row in sys_file points to the default storage UID.

Detection Strategies

Audit all site TYPO3 forms (.form.yaml definitions) for FileUpload and ImageUpload elements that declare a non-default saveToFileMount, and compare their intended destination against actual file locations in sys_file.
Query the TYPO3 database for file references created by the form framework and group by storage UID to surface uploads that bypassed the configured mount.
Review HTTP access logs for retrieval of recently created user_upload/ artifacts, especially filenames matching form submission patterns.

Monitoring Recommendations

Enable file integrity monitoring on fileadmin/user_upload/ and alert on new file creation events.
Forward TYPO3 application and web server logs to a central analytics platform to correlate form submissions with subsequent anonymous file downloads.
Track outbound requests to form-upload URLs over time to identify enumeration attempts against predictable filenames.

How to Mitigate CVE-2026-109162

Immediate Actions Required

Upgrade TYPO3 CMS to version 14.3.9 or later, which contains the fix referenced in TYPO3-CORE-SA-2026-024.
Inventory all forms using FileUpload or ImageUpload with a custom saveToFileMount and treat prior submissions as potentially exposed.
Move or delete misplaced uploads from 1:/user_upload/ to the intended restricted storage after patching.

Patch Information

The TYPO3 project released fixes in commits cc3e8e28 and f536f75c. Both patches relocate the mount-resolution logic into PropertyMappingConfiguration.php so that the configured saveToFileMount is honored by FileUpload. See the TYPO3 Security Advisory 2026-024 for the full advisory and upgrade matrix.

Workarounds

Temporarily disable forms that rely on a custom saveToFileMount until the TYPO3 Core patch is applied.
Restrict web server access to /fileadmin/user_upload/ for file types that should not be publicly retrievable (for example, PDFs or archives) using rules in the front-facing reverse proxy or .htaccess.
Rotate or invalidate any sensitive data that may have been exposed via misplaced uploads.

bash

# Example: upgrade TYPO3 CMS via Composer to a patched release
composer require typo3/cms-core:"^14.3.9" typo3/cms-form:"^14.3.9" --update-with-dependencies

# Verify installed versions
composer show | grep typo3/cms-