CVE-2026-47346

🗓️ 09 Jun 2026 10:50:21Reported by MendType

File write permissions in TYPO3 CMS allow arbitrary SQL injection to escalate privileges.

Reporter	Title	Published	Views	Family All 15
Circl	CVE-2026-47346	10 Jun 202603:07	–	circl
CNNVD	TYPO3 CMS 安全漏洞	9 Jun 202600:00	–	cnnvd
CVE	CVE-2026-47346	9 Jun 202610:50	–	cve
Cvelist	CVE-2026-47346 TYPO3 CMS - Broken Access Control in Form Framework	9 Jun 202610:50	–	cvelist
EUVD	EUVD-2026-35393	12 Jun 202619:32	–	euvd
Friends Of PHP	TYPO3-CORE-SA-2026-008: Broken Access Control in Form Framework	9 Jun 202608:56	–	friendsofphp
Github Security Blog	TYPO3 CMS has Broken Access Control in its Form Framework	12 Jun 202619:32	–	github
NVD	CVE-2026-47346	9 Jun 202611:16	–	nvd
OSV	GHSA-HWVQ-2W67-RVXP TYPO3 CMS has Broken Access Control in its Form Framework	12 Jun 202619:32	–	osv
Positive Technologies	PT-2026-47739	9 Jun 202600:00	–	ptsecurity

Vulners

Node

typo3 cms-coreRange14.0.0–14.3.3

typo3 cms-coreRange10.2.x-dev–10.4.57

typo3 cms-coreRange11.1.x-dev–11.5.51

typo3 cms-coreRange14.0.x-dev–14.3.3

typo3 cms-coreRange13.0.0–13.4.31

typo3 cms-coreRange13.0.x-dev–13.4.31

typo3 cms-coreRange12.1.x-dev–12.4.46

Source	Link
packagist	www.packagist.org/
github	www.github.com/TYPO3/typo3/commit/2030617e6f273cee7b756c695f0a48a45a31eb47
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-47346
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2026-47346.yaml
github	www.github.com/TYPO3/typo3
github	www.github.com/TYPO3/typo3/security/advisories/GHSA-hwvq-2w67-rvxp
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/47xxx/CVE-2026-47346.json
typo3	www.typo3.org/security/advisory/typo3-core-sa-2026-008
github	www.github.com/TYPO3/typo3/commit/eb2b2251d90339d3ab55df3d4c0378ae0c780b45

07 Oct 2026 22:49Current

6.4Medium risk

Vulners AI Score6.4

CVSS 47.6

CVSS 3.18.1

EPSS0.00439

SSVC