CVE-2026-15305: TYPO3 CMS - Unrestricted File Upload in Form Framework
Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15305?
CVE-2026-15305 has a medium severity rating of 6.3 according to the CVSS scoring system.
How do I fix CVE-2026-15305?
To fix CVE-2026-15305, ensure that server-side restrictions on allowed MIME types are properly enforced during file uploads.
What are the risks associated with CVE-2026-15305?
The risks include unauthorized file uploads which could lead to remote code execution or data breaches.
Which version of TYPO3 CMS is affected by CVE-2026-15305?
CVE-2026-15305 affects versions of TYPO3 CMS that use the FileUpload or ImageUpload elements without proper server-side MIME type validation.
Is there a workaround for CVE-2026-15305?
A potential workaround for CVE-2026-15305 is to implement additional server-side checks for uploaded file types until an official patch is applied.