High severity · published Jun 9, 2026
CVE-2026-47343
TYPO3 CMS - Destructive Actions on File Mount Folders
7.2
CVSS
0.2%
EPSS
No
On KEV
Description
Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active file mount due to missing authorization restrictions. This issue affects TYPO3 CMS versions before 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TC
TYPO3 CMS · TYPO3
before 10.4.57; 11.0.0 before 11.5.51; 12.0.0 before 12.4.46; 13.0.0 before 13.4.31; 14.0.0 before 14.3.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-47343
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-47343
github.com
https://github.com/TYPO3/typo3/commit/504e72470ff72aaf5d2256878bf473747f389798
github.com
https://github.com/TYPO3/typo3/commit/ac4125aef8b9b94528a7f74db2444db57b05a87b
typo3.org
https://typo3.org/security/advisory/typo3-core-sa-2026-007
More from TYPO3 CMS
8.8
CVE-2025-59017
Broken Access Control in Backend AJAX Routes
8.7
CVE-2026-49741
TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
8.1
CVE-2025-59022
TYPO3 CMS Allows Broken Access Control in Recycler Module
7.8
CVE-2026-0859
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
7.6
CVE-2026-47346
TYPO3 CMS - Broken Access Control in Form Framework