CVE-2026-49741: 
PHP Analyse et atténuation des vulnérabilités

CVE-2026-49741 is a privilege escalation and SQL injection vulnerability in TYPO3 CMS's Form Framework, formally titled "TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework" (TYPO3-CORE-SA-2026-017). Backend users with write access to the form_definition database table could directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks — effectively re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003. The vulnerability affects TYPO3 CMS versions 14.0.0 through 14.3.2 (fixed in 14.3.3), was published on June 9, 2026, and carries a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, TYPO3 Advisory).

The root cause is a missing authorization guard (CWE-862) on the form_definition database table when TYPO3 implemented database storage for form definitions — the DataHandler access control hook was omitted, allowing direct record manipulation. This omission also re-introduces SQL injection (CWE-89) by permitting arbitrary form configurations to be injected, which can be leveraged to craft malicious SQL via the Form Framework's query mechanisms. An attacker must be an authenticated backend user with write access to the form_definition table; no additional preconditions or user interaction are required. The fix introduces FormDefinitionPersistenceGuard (a request-scoped service using HMAC-SHA3-384 tokens) and FormDefinitionDataHandlerHook to enforce single-use, field-bound invocation grants for all DataHandler create/update/delete operations on form_definition records (GitHub Commit, GitHub Advisory).

Successful exploitation allows an authenticated backend user to inject arbitrary form configurations into the TYPO3 database, enabling SQL injection attacks against the underlying database and privilege escalation within the CMS. The confidentiality and integrity impacts on the vulnerable system are rated High, as an attacker could exfiltrate sensitive data and modify system records; availability impact is rated Low. Lateral movement within the TYPO3 backend or connected database systems is plausible if SQL injection is leveraged to access or modify other tables (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure (Feedly). The EPSS score is approximately 0.027% (0.000270), placing it in a low exploitation probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated backend access with specific database write permissions, which limits the attacker pool but does not eliminate risk in multi-tenant or shared TYPO3 environments (GitHub Advisory).

1. Reconnaissance: Identify a TYPO3 CMS instance running versions 14.0.0–14.3.2 and obtain or compromise a backend user account that has write access to the form_definition database table.
2. Access DataHandler directly: Using the authenticated backend session, craft a direct DataHandler request (e.g., via TYPO3's backend API or a custom extension call) targeting the form_definition table, bypassing the Form Framework's normal UI and validation layer.
3. Inject malicious form configuration: Submit a crafted form_definition record containing a malicious form configuration payload — for example, embedding SQL injection strings in form field definitions or validators that are later processed by the Form Framework's database queries.
4. Trigger SQL injection: Cause the injected form definition to be loaded and processed by the Form Framework (e.g., by rendering or submitting the form on the frontend), which passes the attacker-controlled configuration to database queries without proper sanitization.
5. Achieve privilege escalation or data exfiltration: Leverage the SQL injection to read sensitive data from other database tables (e.g., backend user credentials, session tokens) or modify records to escalate privileges within the TYPO3 backend (GitHub Advisory, TYPO3 Advisory).

• Logs: TYPO3 system log (sys_log) entries showing DataHandler operations (INSERT, UPDATE, DELETE) on the form_definition table originating from non-administrative backend users or unexpected user accounts; log entries with the message 'Persisting form definition via DataHandler is denied' (post-patch) may indicate attempted exploitation on patched systems.
• Database: Unexpected or unauthorized records in the form_definition table, particularly those with unusual configuration field content containing SQL metacharacters, encoded payloads, or references to other database tables.
• Network: Unusual HTTP POST requests to TYPO3 backend endpoints (e.g., /typo3/index.php with route=/record/commit) from backend user sessions not typically associated with form management activity.
• File System: No direct file-system artifacts expected, as the attack operates entirely through the database layer; however, review for unexpected TYPO3 extension files that may have been installed to facilitate DataHandler access.

Update TYPO3 CMS to version 14.3.3 LTS, which introduces the FormDefinitionPersistenceGuard and FormDefinitionDataHandlerHook to enforce authorized DataHandler access on form_definition records (GitHub Advisory, TYPO3 Advisory). As an interim workaround prior to patching, restrict write access to the form_definition database table to trusted administrators only, and audit existing form definitions for unauthorized or suspicious configurations. Monitor TYPO3 system logs for unexpected DataHandler operations on the form_definition table.

The vulnerability was reported by security researcher Selçuk Güney and fixed by TYPO3 core and security team member Oliver Hader (GitHub Advisory). The TYPO3 project published the official advisory TYPO3-CORE-SA-2026-017 on June 9, 2026, and the fix was merged promptly. No significant broader media coverage or notable social media discussion beyond standard CVE tracking feeds has been observed.