Vulnerability advisory

CVE-2026-15305

TYPO3 CMS - Unrestricted File Upload in Form Framework

Published Jul 14, 2026Updated Oct 28, 2026OSV record ↗

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/typo3/typo3 ↗
cfda1147fba7bb5bbe30cf5aedd3277a0a329b3e to before 38d9edb7b288018c0c2b2708a659e2c0215efd9c	`38d9edb7b288018c0c2b2708a659e2c0215efd9c`
Not specified	`817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a`
Not specified	`cfda21050398eb145211a4fa6f9988f10e43e10b`
Also listed as affected (6) `v14.3.4` `v14.3.3` `v14.3.2` `v14.3.1` `v14.3.0` `v14.2.0`

Description

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

CVE-2026-15305

Affected versions

Repository

Description

References