Auth bypass in Typo3 Cms

CVE-2026-47346

Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restriction. Maliciously crafted form definition files can be used to e…

EPSS: 0.003 (16.8th percentile) — read the EPSS interpretation.