### Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks “Ethan” for reporting this issue, and TYPO3 core & security team member Oliver Hader for fixing it. ### Resources * [TYPO3-CORE-SA-2026-019](https://typo3.org/security/advisory/typo3-core-sa-2026-019)
### Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks “Ethan” for reporting this issue, and TYPO3 core & security team member Oliver Hader for fixing it. ### Resources * [TYPO3-CORE-SA-2026-019](https://typo3.org/security/advisory/typo3-core-sa-2026-019)
### Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks “Ethan” for reporting this issue, and TYPO3 core & security team member Oliver Hader for fixing it. ### Resources * [TYPO3-CORE-SA-2026-019](https://typo3.org/security/advisory/typo3-core-sa-2026-019)
### Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks “Ethan” for reporting this issue, and TYPO3 core & security team member Oliver Hader for fixing it. ### Resources * [TYPO3-CORE-SA-2026-019](https://typo3.org/security/advisory/typo3-core-sa-2026-019)
Update typo3/cms-core to 10.4.57; typo3/cms-core to 11.5.51; typo3/cms-core to 12.4.46; typo3/cms-core to 13.4.31; typo3/cms-core to 14.3.3; typo3/cms-form to 10.4.57; typo3/cms-form to 11.5.51; typo3/cms-form to 12.4.46; typo3/cms-form to 13.4.31; typo3/cms-form to 14.3.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanTYPO3 CMS has Broken Access Control in its Form Framework affects typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-form (composer), typo3/cms-form (composer), typo3/cms-form (composer), typo3/cms-form (composer), typo3/cms-form (composer). Severity is high. ### Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks “Ethan” for reporting this issue, and TYPO3 core & security team member Oliver Hader for fixing it. ### Resources * [TYPO3-CORE-SA-2026-019](https://typo3.org/security/advisory/typo3-core-sa-2026-019)
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| typo3/cms-corecomposer | <10.4.57 | 10.4.57 |
| typo3/cms-corecomposer | >=11.0.0,<11.5.51 | 11.5.51 |
| typo3/cms-corecomposer | >=12.0.0,<12.4.46 | 12.4.46 |
| typo3/cms-corecomposer | >=13.0.0,<13.4.31 | 13.4.31 |
| typo3/cms-corecomposer | >=14.0.0,<14.3.3 | 14.3.3 |
| typo3/cms-formcomposer | <10.4.57 | 10.4.57 |
| typo3/cms-formcomposer | >=11.0.0,<11.5.51 | 11.5.51 |
| typo3/cms-formcomposer |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate typo3/cms-core to 10.4.57; typo3/cms-core to 11.5.51; typo3/cms-core to 12.4.46; typo3/cms-core to 13.4.31; typo3/cms-core to 14.3.3; typo3/cms-form to 10.4.57; typo3/cms-form to 11.5.51; typo3/cms-form to 12.4.46; typo3/cms-form to 13.4.31; typo3/cms-form to 14.3.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanTYPO3 CMS has Broken Access Control in its Form Framework affects typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-core (composer), typo3/cms-form (composer), typo3/cms-form (composer), typo3/cms-form (composer), typo3/cms-form (composer), typo3/cms-form (composer). Severity is high. ### Problem Backend users with access to the Form Framework were able to use files not ending in `.form.yaml` as form definitions, which were processed without denying the incorrect file extension. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. ### Solution Update to TYPO3 versions 10.4.57 ELTS, 11.5.51 ELTS, 12.4.46 ELTS, 13.4.31 LTS, 14.3.3 LTS that fix the problem described. ### Credits TYPO3 CMS thanks “Ethan” for reporting this issue, and TYPO3 core & security team member Oliver Hader for fixing it. ### Resources * [TYPO3-CORE-SA-2026-019](https://typo3.org/security/advisory/typo3-core-sa-2026-019)
AI coding agents often install or upgrade packages automatically in composer. A high vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| typo3/cms-corecomposer | <10.4.57 | 10.4.57 |
| typo3/cms-corecomposer | >=11.0.0,<11.5.51 | 11.5.51 |
| typo3/cms-corecomposer | >=12.0.0,<12.4.46 | 12.4.46 |
| typo3/cms-corecomposer | >=13.0.0,<13.4.31 | 13.4.31 |
| typo3/cms-corecomposer | >=14.0.0,<14.3.3 | 14.3.3 |
| typo3/cms-formcomposer | <10.4.57 | 10.4.57 |
| typo3/cms-formcomposer | >=11.0.0,<11.5.51 | 11.5.51 |
| typo3/cms-formcomposer |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| >=12.0.0,<12.4.46 |
| 12.4.46 |
| typo3/cms-formcomposer | >=13.0.0,<13.4.31 | 13.4.31 |
|---|
| typo3/cms-formcomposer | >=14.0.0,<14.3.3 | 14.3.3 |
|---|
| >=12.0.0,<12.4.46 |
| 12.4.46 |
| typo3/cms-formcomposer | >=13.0.0,<13.4.31 | 13.4.31 |
|---|
| typo3/cms-formcomposer | >=14.0.0,<14.3.3 | 14.3.3 |
|---|