CVE-2026-109162: 
PHP vulnerability analysis and mitigation

CVE-2026-109162 is a misconfigured file storage vulnerability in TYPO3 CMS affecting the typo3/cms-form extension. When forms use FileUpload or ImageUpload elements with a custom saveToFileMount configured, uploaded files are incorrectly stored in the default public storage folder 1:/user_upload/ instead of the intended destination. This means files intended for restricted, non-public storage become publicly accessible and are served without access control checks. The vulnerability affects TYPO3 CMS versions 14.0.0 through 14.3.8, and was published on October 13, 2026. It carries a CVSS v4.0 base score of 6.3 (Medium) (EUVD, TYPO3 Advisory).

The root cause is classified under CWE-552 (Files or Directories Accessible to External Parties) and CWE-696 (Incorrect Behavior Order), indicating that the form processing logic fails to correctly apply the custom saveToFileMount configuration before writing uploaded files to disk. Instead of routing uploads to the administrator-configured restricted storage, the system defaults to the publicly accessible 1:/user_upload/ directory. This incorrect ordering of operations means the access restriction logic is effectively bypassed for the storage destination. Forms using the default saveToFileMount value are not affected — only those with a custom, non-default mount configured are vulnerable (EUVD, TYPO3 Advisory).

The primary impact is an unauthorized disclosure of uploaded files that were intended to be stored in restricted, non-public storage. Because the files are placed in a publicly accessible directory and served directly without access checks, any user — including unauthenticated visitors — may be able to access sensitive uploaded content such as documents, images, or other user-submitted files. The confidentiality impact is rated Low in the CVSS v4.0 scoring, with no integrity or availability impact, but the real-world risk depends heavily on the sensitivity of the data submitted through affected forms (EUVD).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept exploit code at this time. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires that a site has forms configured with a custom saveToFileMount pointing to a non-public storage, and an attacker would need to know or guess the path to the publicly stored files (EUVD).

1. Reconnaissance: Identify TYPO3 CMS instances running versions 14.0.0–14.3.8 using web fingerprinting tools (e.g., Wappalyzer, HTTP response headers, or known TYPO3 URL patterns).
2. Identify vulnerable forms: Browse the target site for forms containing FileUpload or ImageUpload elements, which may be visible on contact, registration, or submission pages.
3. Upload a file: Submit a file through the vulnerable form. Due to the misconfiguration, the file will be stored in 1:/user_upload/ (the default public storage) rather than the intended restricted mount.
4. Access the uploaded file: Attempt to directly access the uploaded file via the public web path (e.g., https://example.com/fileadmin/user_upload/<filename>). If the file is accessible without authentication, the vulnerability is confirmed and sensitive uploaded content can be retrieved (EUVD, TYPO3 Advisory).

• File System: Unexpected files appearing in the fileadmin/user_upload/ directory that should have been stored in a restricted, non-public file mount as configured in the form's saveToFileMount setting.
• Logs: Web server access logs showing direct HTTP GET requests to fileadmin/user_upload/<filename> for files that were submitted through restricted forms, particularly from unauthenticated or external IP addresses.
• Application Logs: TYPO3 system logs may show form submissions where the destination storage mount does not match the configured saveToFileMount value.

TYPO3 has released version 14.3.9 of typo3/cms-form, which corrects the incorrect behavior order so that uploaded files are stored in the administrator-configured saveToFileMount destination. Administrators should upgrade to TYPO3 CMS 14.3.9 or later immediately. As a temporary workaround prior to patching, administrators can audit the fileadmin/user_upload/ directory for unexpectedly stored files and restrict direct web access to that directory, or temporarily disable affected forms that use a custom saveToFileMount (TYPO3 Advisory, EUVD).