What’s Vulnerable › Vulnerabilities

CVE-2026-47343: TYPO3 CMS - Destructive Actions on File Mount Folders

• Severity: high (CVSS 7.2 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-06-09 · updated 2026-07-23
• Weakness: CWE-862

Description

Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.

Affected products

• typo3: before 10.4.57; from 11.0.0 before 11.5.51; from 12.0.0 before 12.4.46; from 13.0.0 before 13.4.31; from 14.0.0 before 14.3.3 — fixed in 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3

How to fix

Upgrade to a fixed version: typo3 10.4.57, 11.5.51, 12.4.46, 13.4.31. Check the vendor advisory for mitigations.

References

• https://github.com/TYPO3/typo3/commit/504e72470ff72aaf5d2256878bf473747f389798
• https://github.com/TYPO3/typo3/commit/ac4125aef8b9b94528a7f74db2444db57b05a87b
• https://typo3.org/security/advisory/typo3-core-sa-2026-007

Get alerted when CVE-2026-47343 or the next vulnerability affects your stack