CVE-2026-49741 json
TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
published 2026-06-09 5 mo ago modified 2026-09-10 1 mo ago also GHSA-jh32-v29g-68pq , EUVD-2026-35402
- cvss
- 8.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 15%
- public exploits
- 0
- none known
Summary
Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.
Patch / fix
- packagist typo3/cms-core 14.3.3
- packagist typo3/cms-form 14.3.3
- TYPO3 TYPO3 CMS 14.3.3
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 5 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 15% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | typo3/cms-core | >=14.0.0, <14.3.3 |
14.3.3 |
| packagist | typo3/cms-form | >=14.0.0, <14.3.3 |
14.3.3 |
Affected products
- TYPO3 TYPO3 CMS
Classification
References
-
github.com
/TYPO3/typo3/commit/c90493c13b633f328cf2c066182c90a1655ff0fc
patch, web
-
typo3.org
/security/advisory/typo3-core-sa-2026-017
vendor-advisory, web
-
typo3.org
/security/advisory/typo3-core-sa-2018-003
related, web
-
github.com
/TYPO3/typo3/security/advisories/GHSA-jh32-v29g-68pq
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-49741
advisory
-
github.com
/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49741.yaml
web
-
github.com
/TYPO3/typo3
package
Sources
- CVE List CVE-2026-49741
- GitHub Advisory GHSA-jh32-v29g-68pq
- NVD CVE-2026-49741
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.