Is CVE-2026-109162 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109162 being exploited in the wild.

How severe is CVE-2026-109162?

Informational severity, published 13 October 2026.

Which products and versions are affected?

Typo3 CMS 14.0.0 through 14.3.8.

Is there a fix for CVE-2026-109162?

Yes: fixed in 14.4.0 or later; also available in backported fixes for earlier versions on 14.3 branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-109162 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-109162?

Check whether you run Typo3 CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109162: TYPO3 CMS FileUpload/ImageUpload storage bypass

CVE-2026-109162 · Severity: info · Published 2026-10-13

TYPO3 is a web content management system used to build and manage websites. When form elements like file or image uploads are configured with a custom restricted storage location, the files may be incorrectly saved to a default public folder instead. This exposes uploaded files that should remain private to potential unauthorized access.

Vendors: Typo3.

Quick answers

Is CVE-2026-109162 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109162 being exploited in the wild.
How severe is CVE-2026-109162?: Informational severity, published 13 October 2026.
Which products and versions are affected?: Typo3 CMS 14.0.0 through 14.3.8.
Is there a fix for CVE-2026-109162?: Yes: fixed in 14.4.0 or later; also available in backported fixes for earlier versions on 14.3 branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109162 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-109162?: Check whether you run Typo3 CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 14.4.0 or later; also available in backported fixes for earlier versions on 14.3 branch

Technical details

Forms using FileUpload or ImageUpload elements with saveToFileMount configured to a custom destination failed to respect that configuration due to folder resolution occurring before element properties were applied, causing files to default to the public 1:/user_upload/ folder. An attacker could upload files expecting them to be stored in a restricted storage and have them end up in public storage served without access control. The issue affects form-initiated uploads only; forms using the default saveToFileMount value are not affected.

Affected products

TYPO3 CMS 14.0.0 through 14.3.8

Timeline

2026-10-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.