CVE-2026-47343
HIGHTYPO3 CMS - Destructive Actions on File Mount Folders
Title source: cnaDescription
Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.
References (3)
Core 3
Core References
Vendor Advisory vendor-advisory
https://typo3.org/security/advisory/typo3-core-sa-2026-007
Patch patch
Git commit of main branch
https://github.com/TYPO3/typo3/commit/504e72470ff72aaf5d2256878bf473747f389798
Patch patch
Git commit of 13.4 branch
https://github.com/TYPO3/typo3/commit/ac4125aef8b9b94528a7f74db2444db57b05a87b
Scores
CVSS v4
7.2
EPSS
0.0004
EPSS Percentile
11.3%
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-862
Status
published
Products (10)
typo3/cms-core
0 - 10.4.57Packagist
typo3/cms-core
11.0.0 - 11.5.51Packagist
typo3/cms-core
12.0.0 - 12.4.46Packagist
typo3/cms-core
13.0.0 - 13.4.31Packagist
typo3/cms-core
14.0.0 - 14.3.3Packagist
TYPO3/TYPO3 CMS
< 10.4.57
TYPO3/TYPO3 CMS
11.0.0 - 11.5.51
TYPO3/TYPO3 CMS
12.0.0 - 12.4.46
TYPO3/TYPO3 CMS
13.0.0 - 13.4.31
TYPO3/TYPO3 CMS
14.0.0 - 14.3.3
Published
Jun 09, 2026
Tracked Since
Jun 09, 2026