CVE-2026-109162
Received Received - Intake

Incorrect File Storage Path in TYPO3 CMS Leading to Public Access

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: TYPO3

Description
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109162
EUVD
EUVD-2026-98410

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TYPO3 TYPO3 CMS 14.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-552 The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-696 The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects TYPO3 CMS versions 14.0.0-14.3.8. Forms using FileUpload or ImageUpload elements with a custom saveToFileMount setting store uploaded files in the default public storage folder instead of the configured restricted location. This could expose sensitive files to public access since they are served without proper access checks.

Detection Guidance

Check TYPO3 CMS version with: grep 'typo3/cms' composer.lock or composer show typo3/cms-core. Inspect Form Framework configurations for FileUpload/ImageUpload elements with custom saveToFileMount settings pointing to 1:/user_upload/. Review file storage paths in form setup and verify uploaded files are not in public user_upload directory.

Impact Analysis

If you use affected TYPO3 CMS versions with custom saveToFileMount settings, uploaded files may be stored in a publicly accessible location. This could lead to unauthorized access to sensitive files, data leaks, or compliance violations depending on the file content.

Compliance Impact

This vulnerability could lead to unauthorized public exposure of sensitive data, potentially violating GDPR (data protection), HIPAA (health information privacy), or other regulations requiring controlled access to stored files. Publicly accessible files without proper access checks may result in non-compliance.

Mitigation Strategies

Upgrade TYPO3 CMS to version 14.3.9 LTS or later. Review and correct saveToFileMount configurations in forms using FileUpload/ImageUpload elements to ensure files are stored in intended restricted locations. Remove any files incorrectly stored in 1:/user_upload/ if they contain sensitive data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart