CVE-2026-109162
6.3MediumPublished 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-552, CWE-696
Impact
Unauthenticated attackers can publicly access sensitive uploaded files without authorization. The issue occurs if forms use custom saveToFileMount locations that are bypassed in favor of the public user_upload directory.
Root cause
Form file upload handling ignores custom saveToFileMount configurations and writes files to the default publicly accessible storage folder instead.
Affected systems
TYPO3 CMS 14.0.0 through 14.3.8
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade TYPO3 CMS to version 14.3.9 or newer. As an interim workaround, restrict web server access to the '1:/user_upload/' directory or temporarily avoid using custom saveToFileMount form uploads.
$ composer update typo3/cms-core --with-dependenciesAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.