GHSA-45wj-jv2h-jwrf: TYPO3 CMS Privilege Escalation and SQL Injection

The vulnerability stems from two primary issues: improper input validation in the form editor and insecure file handling via FAL. The form editor's save/preview actions did not filter user-submitted form definitions against allowed properties (CWE-89), enabling SQL injection through malicious YAML configurations. Additionally, functions like moveFile and func_edit in FAL-related classes allowed direct manipulation of form definition files (.form.yaml) without proper authorization checks, leading to privilege escalation. The patches introduced validation() checks in the form editor and restricted FAL operations, confirming these functions were vulnerable.