PT-2026-47748 · Typo3 · Typo3/Cms

Oliver Hader + 1 · CVE-2026-49741 · Published 2026-06-09 · Updated 2026-06-16

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 14.0.0 through 14.3.3

Description Backend users with write access to the form definition database table can directly create, update, or delete form definition records using the DataHandler. This process bypasses the Form Framework's persistence validation and permission checks, enabling the injection of arbitrary form configurations. This can lead to SQL injection and privilege escalation.

Recommendations Update TYPO3 CMS to a version later than 14.3.3.

Exploit

Fix

LPE

Missing Authorization

SQL injection

Weakness Enumeration

CWE-862

CWE-89

Related Identifiers

CVE-2026-49741

GHSA-JH32-V29G-68PQ

Affected Products

Typo3/Cms

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/49xxx/CVE-2026-49741.json · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-49741.yaml · Exploit
• https://github.com/TYPO3/typo3/commit/c90493c13b633f328cf2c066182c90a1655ff0fc · Patch
• https://typo3.org/security/advisory/typo3-core-sa-2026-017 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-49741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-49741 · Security Note
• https://osv.dev/vulnerability/GHSA-jh32-v29g-68pq · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-jh32-v29g-68pq · Note
• https://typo3.org/security/advisory/typo3-core-sa-2018-003 · Note
• https://packagist.org · Note
• https://twitter.com/selcukgny/status/2066977152202138014 · Twitter Post
• https://twitter.com/CVEnew/status/2064342498130969051 · Twitter Post