CVE-2026-11607: TYPO3 CMS Privilege Escalation Flaw

CVE-2026-11607 Overview

CVE-2026-11607 affects the TYPO3 CMS Form Framework, where backend users with form management access could supply form definition files that did not end in .form.yaml. The framework processed these files without rejecting the invalid extension. Attackers leveraged this validation gap to load maliciously crafted form definitions that executed arbitrary SQL statements. Successful exploitation allowed creation of administrative backend accounts, resulting in full privilege escalation within the CMS. The flaw is classified under [CWE-862] Missing Authorization controls on file extension validation.

Critical Impact
Authenticated backend users can escalate to administrative privileges by injecting SQL through malformed form definition files processed by the TYPO3 Form Framework.

Affected Products

TYPO3 CMS versions prior to 10.4.57
TYPO3 CMS 11.0.0 through 11.5.51 and 12.0.0 through 12.4.46
TYPO3 CMS 13.0.0 through 13.4.31 and 14.0.0 through 14.3.3

Discovery Timeline

2026-06-09 - CVE-2026-11607 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-11607

Vulnerability Analysis

The TYPO3 Form Framework uses YAML files to define backend forms. The persistence manager was expected to enforce the .form.yaml extension before processing user-supplied content. The validation routine generateErrorsIfFormDefinitionIsValidButHasInvalidFileExtension only raised an error when the file both looked like a form definition AND had an invalid extension. Files that did not match the form definition heuristic were silently accepted regardless of extension. Attackers crafted YAML payloads that bypassed the structural check while still triggering downstream SQL execution paths. The result was authenticated SQL injection that could create new administrative be_users records.

Root Cause

The root cause is faulty boolean logic in the extension validation guard. The original method combined conditions with &&, requiring both a valid-looking form structure and an invalid extension to raise an error. The corrected logic uses || to reject any file that is either not a valid form definition or lacks the .form.yaml extension. This is a missing authorization check on file metadata [CWE-862].

Attack Vector

Exploitation requires authenticated access to the TYPO3 backend with Form Framework permissions. An attacker uploads or references a YAML file with an arbitrary extension containing a malicious form definition. The Form Framework loads the file through FormPersistenceManager, processes the YAML, and triggers SQL statements that the attacker controls. The attacker uses these statements to insert a new administrator account into the user table.

php

// Patched validation logic in FormPersistenceManager.php and AbstractFileStorageAdapter.php
// Source: https://github.com/TYPO3/typo3/commit/50974c658f647f1aece347b5d6d5acc3c87f2dca

-    protected function generateErrorsIfFormDefinitionIsValidButHasInvalidFileExtension(array $formDefinition, string $identifier): void
+    protected function generateErrorsIfFormDefinitionIsInvalidOrHasInvalidFileExtension(array $formDefinition, string $identifier): void
     {
-        if ($this->looksLikeAFormDefinitionArray($formDefinition) && !$this->hasValidFileExtension($identifier)) {
+        if (!$this->looksLikeAFormDefinitionArray($formDefinition) || !$this->hasValidFileExtension($identifier)) {
             throw new PersistenceManagerException(sprintf('Form definition "%s" does not end with ".form.yaml".', $identifier), 1531160649);
         }
     }

Detection Methods for CVE-2026-11607

Indicators of Compromise

Unexpected new entries in the be_users table, particularly accounts with admin=1 set outside normal provisioning workflows.
YAML files in form storage directories whose names do not end in .form.yaml.
Backend audit log entries showing form persistence operations referencing unusual file paths or extensions.

Detection Strategies

Review TYPO3 system logs (sys_log) for form module activity correlated with unauthorized administrator account creation.
Hunt the filesystem for YAML files inside form storage adapters that lack the .form.yaml suffix and inspect their contents for SQL-like payloads.
Compare administrator account inventories against authorized change records to identify rogue privilege escalations.

Monitoring Recommendations

Enable verbose logging on the Form Framework persistence layer and forward backend authentication events to a centralized log platform.
Alert on changes to the be_users table outside of approved deployment windows.
Monitor for unexpected writes to directories configured as form storage adapters.

How to Mitigate CVE-2026-11607

Immediate Actions Required

Upgrade TYPO3 CMS to a fixed release: 10.4.57, 11.5.52, 12.4.47, 13.4.32, or 14.3.4 as appropriate for your branch.
Audit all backend user accounts and remove any administrator accounts that cannot be attributed to a legitimate change request.
Review Form Framework permissions and revoke access for users who do not require form authoring capabilities.

Patch Information

TYPO3 published the fix in security advisory TYPO3-CORE-SA-2026-019. The patches in commits 040d50d and 50974c6 replace the faulty validation method with generateErrorsIfFormDefinitionIsInvalidOrHasInvalidFileExtension, which rejects any file lacking a valid form structure or the .form.yaml extension. See the TYPO3 Security Advisory for full version guidance.

Workarounds

Restrict the Form Framework backend module to trusted administrators until patches are deployed.
Implement filesystem-level controls preventing creation of non-.form.yaml files within configured form storage directories.
Apply database-level least privilege so that the TYPO3 application account cannot perform schema-altering or privilege-modifying statements beyond what the application requires.

bash

# Verify installed TYPO3 version and update via Composer
composer show typo3/cms-core | grep versions
composer require typo3/cms-core:^13.4.32 --update-with-dependencies
vendor/bin/typo3 cache:flush