CVE-2026-15305: TYPO3 CMS - Unrestricted File Upload in Form Framework
Problem Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured - uploading PHP files was not possible. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.
Solution Update to TYPO3 version 14.3.5 LTS that fixes the problem described.
Credits Thanks to Sébastien Convers for reporting this issue, and to Josua Vogel and Oliver Hader for fixing it.
Other sources
Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 14.3.5 - Upgrade
Upgrade
TYPO3 CMSto a version that resolves this vulnerability.Fixed in 14.3.5
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15305?
CVE-2026-15305 has a medium severity rating of 6.3 according to the CVSS scoring system.
How do I fix CVE-2026-15305?
To fix CVE-2026-15305, ensure that server-side restrictions on allowed MIME types are properly enforced during file uploads.
What are the risks associated with CVE-2026-15305?
The risks include unauthorized file uploads which could lead to remote code execution or data breaches.
Which version of TYPO3 CMS is affected by CVE-2026-15305?
CVE-2026-15305 affects versions of TYPO3 CMS that use the FileUpload or ImageUpload elements without proper server-side MIME type validation.
Is there a workaround for CVE-2026-15305?
A potential workaround for CVE-2026-15305 is to implement additional server-side checks for uploaded file types until an official patch is applied.