CVE-2026-47346: TYPO3 CMS Privilege Escalation Flaw

CVE-2026-47346 Overview

CVE-2026-47346 is a high-severity vulnerability in the TYPO3 CMS Form Framework. Backend users with file write permissions can bypass upload restrictions by submitting form definition files with mixed-case extensions such as .FORM.YAML. Maliciously crafted form definition files can execute arbitrary SQL statements against the TYPO3 database. Attackers can leverage this to create administrative backend user accounts and escalate privileges. The flaw stems from a case-sensitivity weakness classified under [CWE-178] (Improper Handling of Case Sensitivity). TYPO3 has issued fixed releases across all supported branches.

Critical Impact
Authenticated backend users can escalate to administrative privileges by uploading form definition files with mixed-case extensions that bypass filename validation, leading to arbitrary SQL execution.

Affected Products

TYPO3 CMS versions before 10.4.57
TYPO3 CMS versions 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, and 13.0.0 through 13.4.30
TYPO3 CMS versions 14.0.0 through 14.3.2

Discovery Timeline

2026-06-09 - CVE-2026-47346 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-47346

Vulnerability Analysis

The TYPO3 Form Framework allows backend editors to manage form definition files stored as YAML. Upload validation rejects files based on a case-sensitive comparison of the .form.yaml extension. By submitting filenames such as payload.FORM.YAML or payload.Form.Yaml, attackers bypass the allowlist while the framework still parses the file as a valid form definition. Once loaded, the YAML content is interpreted by the framework's deserialization and database layers. An attacker can embed instructions that trigger arbitrary SQL statement execution. This enables creation of new backend users with administrator role assignments, granting full control over the CMS instance.

Root Cause

The root cause is improper handling of case sensitivity in filename extension validation [CWE-178]. The Form Framework compared filename suffixes using strict, lowercase-only matching when blocking dangerous uploads. File systems and downstream parsers, however, treat extensions case-insensitively for routing and execution. This mismatch produced a TOCTOU-style validation gap between what the upload filter rejected and what the parser accepted.

Attack Vector

Exploitation requires an authenticated backend user account with file write permissions. The attacker uploads a crafted YAML form definition file using a mixed-case extension. When the file is referenced or rendered by the Form Framework, the embedded payload triggers SQL statements that insert a new be_users record with administrator privileges. The attacker then authenticates as the newly created administrator to take full control. Technical details are documented in the TYPO3 Security Advisory and the upstream GitHub Commit Fix.

Detection Methods for CVE-2026-47346

Indicators of Compromise

Files in TYPO3 storage directories with form definition extensions in uppercase or mixed case, such as .FORM.YAML, .Form.Yaml, or .form.YAML.
Unexpected new entries in the be_users table with administrator role (admin=1) and recent crdate timestamps.
Backend login events from unfamiliar usernames shortly after a file upload event by a non-administrative editor.

Detection Strategies

Audit web server and TYPO3 file abstraction layer logs for upload requests whose filenames match the regex \.(form|yaml) in non-lowercase form.
Query the TYPO3 database for be_users rows created after the patch window with elevated privileges and correlate against authorized provisioning records.
Review TYPO3 system logs (sys_log) for form definition rendering events tied to files uploaded by editor-level accounts.

Monitoring Recommendations

Enable file integrity monitoring on TYPO3 storage directories used by the Form Framework to flag YAML uploads outside change windows.
Forward TYPO3 backend authentication and user provisioning events to a centralized SIEM for correlation against upload activity.
Alert on creation or modification of backend administrator accounts in real time, regardless of source.

How to Mitigate CVE-2026-47346

Immediate Actions Required

Upgrade TYPO3 CMS to a patched release: 10.4.57, 11.5.51, 12.4.46, 13.4.31, or 14.3.3 or later.
Audit all backend user accounts and remove any unauthorized administrator accounts created on or after the upload of mixed-case YAML files.
Review file write permissions assigned to backend user groups and revoke them where not strictly required.

Patch Information

TYPO3 has released fixes addressed in TYPO3 Security Advisory TYPO3-CORE-SA-2026-008. The corrective code is available in the GitHub Commit Fix and the associated GitHub Commit Update, which normalize filename extensions to lowercase before validation.

Workarounds

Restrict the Form Framework upload directory using web server rules that reject any file whose extension does not match a lowercase allowlist.
Temporarily remove file write permissions from non-administrative backend groups until the patch is applied.
Disable the Form Framework module on instances where it is not actively required.

bash

# Example Apache rule to block non-lowercase YAML form uploads
<FilesMatch "\.(?i:form\.yaml)$">
    <If "%{REQUEST_URI} !~ m#\.form\.yaml$#">
        Require all denied
    </If>
</FilesMatch>