CVE-2026-109162: TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework

unknown Affects typo3/cms-form. Feed 2026.10.29.4, updated 2026-10-29; CVE published 2026.

TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework

Package: typo3/cms-form Composer
Affected versions: >=14.0.0 and <14.3.9
Fixed in: 14.3.9
Severity: unknown
Exploitation: not on CISA KEV · EPSS 0% (31.0th percentile)
Source: friendsofphp

References

https://news.typo3.com/security/advisory/typo3-core-sa-2026-024

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden deps composer.lock

# or, without Composer
pipx install phpwarden   &&   phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2021-21355 high Unrestricted File Upload in Form Framework same package: typo3/cms-form
CVE-2021-21357 high Broken Access Control in Form Framework same package: typo3/cms-form
CVE-2021-21358 medium Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in ty same package: typo3/cms-form
CVE-2026-15305 medium TYPO3 CMS - Unrestricted File Upload in Form Framework same package: typo3/cms-form
CVE-2026-47346 high TYPO3 CMS has Broken Access Control in its Form Framework same package: typo3/cms-form
CVE-2026-49741 high TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework same package: typo3/cms-form