CVE-2026-109162
Description
Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/user_upload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted, non-public storage had been configured. Files stored this way are served directly, without the access checks applied to non-public storages. Forms that use the default value for saveToFileMount are not affected. This issue affects TYPO3 CMS versions 14.0.0-14.3.8.
How to fix
- TYPO3 TYPO3 CMS14.3.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| TYPO3 TYPO3 CMS | 14.0.0 ≤ v < 14.3.9 | 14.3.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.