TYPO3-CORE-SA-2026-020: TYPO3 CMS - Unrestricted File Upload in Form Framework

PKSA-d4vj-m6hn-xm1j CVE-2026-15305

Affected version: >=14.2.0,<14.3.5

Reported by:
FriendsOfPHP/security-advisories

[HIGH] TYPO3 CMS has Broken Access Control in its Form Framework

PKSA-8hzt-dvj5-mc5s CVE-2026-11607 GHSA-pjpj-v387-x4vq

Affected version: >=14.0.0,<14.3.3|>=13.0.0,<13.4.31|>=12.0.0,<12.4.46|>=11.0.0,<11.5.51|<10.4.57

Reported by:
GitHub

[HIGH] TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

PKSA-w8hs-qvzm-sf5x CVE-2026-49741 GHSA-jh32-v29g-68pq

Affected version: >=14.0.0,<14.3.3

Reported by:
GitHub

[HIGH] TYPO3 CMS has Broken Access Control in its Form Framework

PKSA-m239-hcqk-kg59 CVE-2026-47346 GHSA-hwvq-2w67-rvxp

Affected version: >=14.0.0,<14.3.3|>=13.0.0,<13.4.31|>=12.0.0,<12.4.46|>=11.0.0,<11.5.51|<10.4.57

Reported by:
GitHub