Backend users granted access to TYPO3’s Form Framework could load form definition files with any extension. The system processed these files without checking for a .form.yaml suffix, allowing maliciously crafted definitions to execute arbitrary SQL statements. This exposure lets an attacker elevate privileges, including the creation of administrative backend user accounts. The vulnerability is a classic Missing Authorization flaw, classified as CWE‑862.

TYPO3 CMS is affected in all releases prior to 10.4.57, 11.5.51, 12.4.46, 13.4.31 and 14.3.3. The issue arises for any installation where backend users have permission to use the Form Framework.

The CVSS score of 7.6 indicates a high severity vulnerability. The EPSS score is not available, so current exploitation probability is unknown, but the lack of an EPSS entry does not reduce the risk posed by the flaw. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector requires an authenticated backend user with form framework permissions; an attacker with such access can perform the exploit by uploading or referencing a malicious file. Given the internal nature of the attack surface, organisations with untrusted backend users or lack of audit on form permissions should treat this risk as significant.