TYPO3 CMS allows backend users with file write permissions to upload form definition files. The system enforces extensions in a case‑sensitive way, so files with mixed‑case extensions such as .FORM.YAML bypass the restriction. An attacker may then craft a malicious form definition that contains arbitrary SQL. Executing this SQL lets the attacker create accounts with administrative privileges. The flaw involves improper access control (CWE‑862) and incorrect handling of case‑sensitive file names (CWE‑178), resulting in a privilege‑escalation vulnerability.

Affected systems include TYPO3 CMS versions prior to 10.4.57, 11.0.0 through 11.5.50, 12.0.0 through 12.4.45, 13.0.0 through 13.4.30, and 14.0.0 through 14.3.2.

The CVSS score indicates High severity at 7.6, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires an authenticated backend user with file write permissions, who uploads a mixed‑case form definition to the web interface. The attacker can then execute crafted SQL to create administrative backend accounts, thereby gaining full control of the CMS instance.