A configuration flaw in TYPO3 CMS’s Form Framework causes forms that use FileUpload or ImageUpload elements with a custom saveToFileMount setting to store files in the default storage folder 1:/user_upload/ instead of the intended destination. The default storage is publicly accessible and files placed there are served directly without the normal access checks applied to non‑public storages. As a result, files uploaded through affected forms can be read by anyone with web access, exposing potentially sensitive data, enabling execution of malicious scripts, and bypassing any restrictions that the originally intended storage might have enforced. This is a type of information exposure (CWE‑552) and a failure to enforce access controls (CWE‑696).

The vulnerability affects TYPO3 CMS releases from 14.0.0 through 14.3.8. Systems that have a secure, non‑public storage configured but rely on a custom saveToFileMount for file uploads can be inadvertently leaking content. Forms that use the default saveToFileMount value are not impacted, but administrators still need to audit custom configurations.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is not available, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalogue. Exploitation requires the attacker to have the ability to influence form configuration—typically an administrative role or a compromised backend—and then to upload files. Once uploaded, the files become publicly accessible because they bypass the usual access control. No publicly documented exploits are known, but the impact of a data disclosure or the ability to host malicious content makes remediation urgent.