Backend users with access to the Form Framework can load files that do not end in ".form.yaml" as form definitions. These files are processed even though their extension is incorrect, allowing maliciously crafted definitions to execute arbitrary SQL statements. This capability allows an attacker to escape privileges by creating administrative backend user accounts within the CMS. The flaw is present in all TYPO3 CMS releases before 10.4.57, 11.5.50, 12.4.45, 13.4.30 and 14.3.2.

TYPO3 CMS is affected in all releases before 10.4.57, 11.0.0‑11.5.50, 12.0.0‑12.4.45, 13.0.0‑13.4.30 and 14.0.0‑14.3.2. The issue arises for any installation where backend users have permission to use the Form Framework.

The CVSS score of 7.6 indicates high severity. The EPSS score of < 1% suggests a very low probability of exploitation at the time of analysis, but the vulnerability still allows significant privilege escalation. The flaw is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated backend user with Form Framework permissions; an attacker with such access can perform the exploit by uploading or referencing a malicious file. Given the internal nature of the attack surface, organisations with untrusted backend users or lack of audit on form permissions should treat this risk as significant.