CVE-2026-47346 is a vulnerability in TYPO3 CMS involving improper handling of case sensitivity in file extension checks for form definition uploads. Backend users with file write permissions can upload files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework's upload restrictions. Maliciously crafted files can execute arbitrary SQL statements, allowing attackers to escalate privileges by creating administrative backend user accounts. This affects TYPO3 CMS versions before 10.4.57, 11.0.0-11.5.50, 12.0.0-12.4.45, 13.0.0-13.4.30, and 14.0.0-14.3.2.

Successful exploitation allows attackers with backend file write permissions to execute arbitrary SQL commands, leading to privilege escalation by creating administrative backend user accounts. This compromises the integrity and security of the TYPO3 CMS backend.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict backend user file write permissions and monitor for suspicious uploads with mixed-case extensions.