TYPO3 up to 14.3.8 FileUpload path traversal

Summaryinfo

A vulnerability was found in TYPO3 up to 14.3.8. It has been declared as critical. This impacts an unknown function of the component FileUpload. Executing a manipulation can lead to path traversal. The identification of this vulnerability is CVE-2026-109162. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in TYPO3 up to 14.3.8 and classified as critical. This vulnerability affects some unknown processing of the component FileUpload. The manipulation with an unknown input leads to a path traversal vulnerability. The CWE definition for the vulnerability is CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.

The advisory is available at news.typo3.com. This vulnerability was named CVE-2026-109162 since 10/12/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 10/13/2026). This vulnerability is assigned to T1006 by the MITRE ATT&CK project.

Upgrading to version 14.3.9 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Name

• TYPO3

Version

• 14.3.0
• 14.3.1
• 14.3.2
• 14.3.3
• 14.3.4
• 14.3.5
• 14.3.6
• 14.3.7
• 14.3.8

License

• open-source

Website

• Product: https://typo3.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion