CVE-2026-109162

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 14.0.0 through 14.3.8

Description Forms utilizing FileUpload or ImageUpload elements with a custom saveToFileMount configuration store uploaded files in the default storage folder 1:/user upload/ instead of the intended destination. This behavior can result in files being placed in publicly accessible storage despite the configuration of a restricted, non-public storage. Files stored in this manner are served directly, bypassing the access checks typically applied to non-public storages.

Recommendations Update TYPO3 CMS to a version later than 14.3.8. As a temporary mitigation, avoid using a custom configuration for the saveToFileMount parameter in FileUpload or ImageUpload elements.