typo3/cms-core security advisory
CVE-2026-49741: TYPO3-CORE-SA-2026-017: Privilege Escalation & SQL Injection in Form Framework
CVE-2026-49741 is a high-severity SQL injection vulnerability in the PHP package typo3/cms-core (CVSS 8.7), published 9 June 2026. It is fixed in 14.3.3; earlier versions are affected. Exploiting it needs a low-privilege user account.
high 8.7 published 2026-06-09 · updated 2026-07-23
- Affected versions
- >= 14.0.0, < 14.3.3
- Fixed in
- 14.3.3
- Newest release
- 14.3.10
- Severity
- High · CVSS 8.7
- Type
- SQL injection
CWE-89, CWE-862 - Exploited in the wild
- Not on the CISA KEV list
checked 2026-11-04
Is your typo3/cms-core version affected?
Who can exploit CVE-2026-49741
- Access: A normal, low-privilege user account in the app.
CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
How to fix CVE-2026-49741 in typo3/cms-core
- Find the installed version:
composer show typo3/cms-core. If you never required it yourself,composer why typo3/cms-coreshows which package pulls it in. - Update it:
composer update typo3/cms-core --with-all-dependencies. You need 14.3.3 or newer. - If Composer will not go that high, your composer.json constraint is holding it back. Widen it (for example
"typo3/cms-core": "^14.3.3"if you can take that version), or upgrade the package that requires it. - Run
composer audit. It reads the same advisory data and should no longer list CVE-2026-49741. - Commit composer.lock and deploy it. On the server, run
composer install --no-devfrom the lock file, notcomposer update.
If you cannot upgrade yet
- Make sure user input never reaches the affected query builder or ORM method unvalidated; allow-list column and sort names.
- Give the app's database user only the permissions it needs.
- If your app does not use the affected feature, note that in your audit, but still plan the upgrade.
The CVE-2026-49741 advisory
Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. This allowed injecting arbitrary form configurations, re-enabling attack vectors originally addressed in TYPO3-CORE-SA-2018-003, including SQL injection and privilege escalation. This issue affects TYPO3 CMS versions 14.0.0-14.3.2.
References
- Typo3 security advisory typo3.org
- Typo3 security advisory typo3.org
- Fix commit c90493c github.com
Other typo3/cms-core advisories
- high CVE-2026-19418: TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool 2026-08-11
- high CVE-2026-11607: TYPO3-CORE-SA-2026-019: Broken Access Control in Form Framework 2026-06-09
- medium CVE-2026-49740: TYPO3-CORE-SA-2026-018: Insecure Deserialization in Core API 2026-06-09
- low CVE-2026-49738: TYPO3-CORE-SA-2026-016: Broken Access Control in File Abstraction Layer 2026-06-09
- medium CVE-2026-47352: TYPO3-CORE-SA-2026-015: Broken Access Control in Backend API 2026-06-09
- medium CVE-2026-47351: TYPO3-CORE-SA-2026-014: Broken Access Control in Clipboard 2026-06-09
Related
Need help patching or upgrading? Laskyr does PHP and Laravel security fixes and upgrades. Tell us what you run and we reply with a plan and a price.
Ask about a fixWhere this data comes from
- Affected and fixed versions: the Packagist security advisories API (GitHub Advisory Database and FriendsOfPHP), the same data
composer audituses. Synced 2026-11-03. - Description, score, weakness and references: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Exploited-in-the-wild status: the CISA Known Exploited Vulnerabilities catalog, checked 2026-11-04.
- Compiled by Daniel Lasek at Laskyr from the sources above. The summary, “who can exploit it”, “how to fix it” and hardening sections are our plain-English reading of the record and are generated from it. The quoted description is the record's own text. Spot an error? Tell us.