CVE-2026-47343 json
TYPO3 CMS - Destructive Actions on File Mount Folders
published 2026-06-09 5 mo ago modified 2026-09-10 1 mo ago also GHSA-3v8v-4wg6-r7qh , EUVD-2026-35392
- cvss
- 7.2
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.
Patch / fix
- packagist typo3/cms-core 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
- TYPO3 TYPO3 CMS 10.4.57, 11.5.51, 12.4.46, 13.4.31, 14.3.3
- github.com/TYPO3/typo3@504e724 commit
- github.com/TYPO3/typo3@ac4125a commit
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 7.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | <10.4.57 >=11.0.0, <11.5.51 >=12.0.0, <12.4.46 >=13.0.0, <13.4.31 >=14.0.0, <14.3.3 |
10.4.57 11.5.51 12.4.46 13.4.31 14.3.3 |
Affected products
- TYPO3 TYPO3 CMS
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/TYPO3/typo3/commit/504e72470ff72aaf5d2256878bf473747f389798
patch, web
-
github.com
/TYPO3/typo3/commit/ac4125aef8b9b94528a7f74db2444db57b05a87b
patch, web
-
typo3.org
/security/advisory/typo3-core-sa-2026-007
vendor-advisory, web
-
github.com
/TYPO3/typo3/security/advisories/GHSA-3v8v-4wg6-r7qh
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-47343
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47343.yaml
web
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2026-47343
- GitHub Advisory GHSA-3v8v-4wg6-r7qh
- NVD CVE-2026-47343
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.