Non‑privileged backend users with access to file mounts were able to perform destructive actions such as move, delete, and rename files located at the root of an active file mount. The vulnerability is caused by missing authorization checks, allowing users without sufficient privileges to alter the file system structure. The impact is data loss or corruption and potential loss of access to critical files, which can affect availability and integrity of the content stored within the CMS.

TYPO3 CMS is affected in all releases earlier than 10.4.57, all releases between 11.0.0 and 11.5.50, between 12.0.0 and 12.4.45, between 13.0.0 and 13.4.30, and between 14.0.0 and 14.3.2.

The vulnerability has a CVSS score of 7.2, indicating high severity. EPSS information is not available, and the issue is not listed in the CISA KEV catalog, suggesting that it may not be actively exploited at this time. The likely attack vector is through the TYPO3 backend interface where a user who is authenticated as a non‑privileged backend user can trigger the vulnerable actions. Attackers only need access to an account with file mount permissions; no elevated privileges or external network exposure are required. The lack of defensive checks means that any such user can immediately alter files, posing a significant risk if such accounts exist.