Backend users with access to TYPO3’s Form Framework could load form definition files with any file extension. The system processed these files without checking for a .form.yaml suffix, allowing maliciously crafted definitions to execute arbitrary SQL statements. This exposure lets an attacker elevate privileges, including the creation of administrative backend user accounts.

TYPO3 CMS is affected in all releases before 10.4.57, 11.0.0‑11.5.50, 12.0.0‑12.4.45, 13.0.0‑13.4.30 and 14.0.0‑14.3.2. The issue arises for any installation where backend users have permission to use the Form Framework.

The CVSS score of 7.6 indicates high severity. The EPSS score of < 1% suggests a very low probability of exploitation at the time of analysis, but the vulnerability still allows significant privilege escalation. The flaw is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated backend user with Form Framework permissions; an attacker with such access can perform the exploit by uploading or referencing a malicious file. Given the internal nature of the attack surface, organisations with untrusted backend users or lack of audit on form permissions should treat this risk as significant.