---
title: "TYPO3 14.3.9—What’s Changed?"
url: "https://b13.com/release-digests/v14/typo3-1439-whats-changed"
date: 2026-10-13
modified: 2026-10-13
lastUpdated: 2026-10-13
---

# TYPO3 14.3.9—What’s Changed?

TYPO3 14.3.9—What’s Changed?
==============================

Released: October 13, 2026
Update type: Security release

TYPO3 14.3.9 is a security release addressing a file upload vulnerability in the form framework. Additionally, this release includes over 30 bug fixes covering workspace handling, FlexForms, FAL operations, routing, and backend usability improvements.

  Security Fixes
----------------

- **Form upload file mount restriction** — Fixed a security issue where the `saveToFileMount` setting of form uploads was not properly respected, potentially allowing files to be saved outside intended directories.

   Editing & UX Improvements
-------------------------------

- **Element browser modal** — The element browser now opens in full-size modal for better usability.
- **CKEditor initialization** — Fixed CKEditor initialization to only occur after the document is fully parsed, preventing potential errors.
- **TCAdefaults handling** — Fixed applying default values to fields outside a type’s showitem configuration, and now correctly handles 0 as a valid default value.
- **FlexForm radio labels** — Radio field labels in FlexForms are now properly resolved and displayed.

   Backend & Administration
------------------------------

- **Reports module FAL stability** — The reports module no longer crashes when encountering unreadable FAL folders.
- **Backend live search** — Fixed a crash in backend live search for users without page mounts.
- **TER extension list** — Extended support for longer extension titles in the TYPO3 Extension Repository listing.
- **Upgrade wizards state** — Upgrade wizards now correctly maintain their ‘done’ state when no update is necessary.

   Technical Changes
-------------------

- **Workspace operations** — Improved workspace handling: fixed keeping excluded unique values when moving records, preserved live UIDs of non-child relations, and now uses native discard command when deleting workspaces.
- **Routing improvements** — Route requirements are now properly passed to the Symfony router, and invalid route parameters trigger fallback to the next route instead of failing.
- **Import/export** — Translated relations are now correctly preserved during imports.
- **Extbase configuration caching** — Backend configuration is now cached in the Extbase ConfigurationManager for better performance.
- **LanguageMenuProcessor state** — Fixed state reset issue in LanguageMenuProcessor to prevent data bleeding between calls.
- **File operations** — File permissions are now always fixed on creation, and image extensions are compared case-insensitively in resize operations.

  - [Download TYPO3 14](https://get.typo3.org/version/14)
- [Official release announcement](https://news.typo3.com/article/typo3-1439-security-release-published)
- [Full changelog](https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog-14/Index.html)