Skip directly to page content
b13 GmbH

Hauptstätter Str. 59
70178 Stuttgart
Germany +49 (0) 711 460 589 70 [email protected]

TYPO3 14.3.9—What’s Changed?

Released: October 13, 2026
Update type: Security release

TYPO3 14.3.9 is a security release addressing a file upload vulnerability in the form framework. Additionally, this release includes over 30 bug fixes covering workspace handling, FlexForms, FAL operations, routing, and backend usability improvements.

Security Fixes

  • Form upload file mount restriction — Fixed a security issue where the saveToFileMount setting of form uploads was not properly respected, potentially allowing files to be saved outside intended directories.

Editing & UX Improvements

  • Element browser modal — The element browser now opens in full-size modal for better usability.
  • CKEditor initialization — Fixed CKEditor initialization to only occur after the document is fully parsed, preventing potential errors.
  • TCAdefaults handling — Fixed applying default values to fields outside a type’s showitem configuration, and now correctly handles 0 as a valid default value.
  • FlexForm radio labels — Radio field labels in FlexForms are now properly resolved and displayed.

Backend & Administration

  • Reports module FAL stability — The reports module no longer crashes when encountering unreadable FAL folders.
  • Backend live search — Fixed a crash in backend live search for users without page mounts.
  • TER extension list — Extended support for longer extension titles in the TYPO3 Extension Repository listing.
  • Upgrade wizards state — Upgrade wizards now correctly maintain their ‘done’ state when no update is necessary.

Technical Changes

  • Workspace operations — Improved workspace handling: fixed keeping excluded unique values when moving records, preserved live UIDs of non-child relations, and now uses native discard command when deleting workspaces.
  • Routing improvements — Route requirements are now properly passed to the Symfony router, and invalid route parameters trigger fallback to the next route instead of failing.
  • Import/export — Translated relations are now correctly preserved during imports.
  • Extbase configuration caching — Backend configuration is now cached in the Extbase ConfigurationManager for better performance.
  • LanguageMenuProcessor state — Fixed state reset issue in LanguageMenuProcessor to prevent data bleeding between calls.
  • File operations — File permissions are now always fixed on creation, and image extensions are compared case-insensitively in resize operations.