CVE-2026-15305: TYPO3 CMS - Unrestricted File Upload in Form Framework

Published Jul 14, 2026
·
Updated

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

Affected Software

1 affected component
Typo3 TYPO3 CMS>=14.2.0<=14.3.4

Event History

Jul 14, 2026
CVE Published
via MITRE·12:45 PM
Data Sourced
via MITRE·12:45 PM
DescriptionWeakness
Data Sourced
via NVD·01:18 PM
DescriptionSeverityWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-15305?

CVE-2026-15305 has a medium severity rating of 6.3 according to the CVSS scoring system.

2

How do I fix CVE-2026-15305?

To fix CVE-2026-15305, ensure that server-side restrictions on allowed MIME types are properly enforced during file uploads.

3

What are the risks associated with CVE-2026-15305?

The risks include unauthorized file uploads which could lead to remote code execution or data breaches.

4

Which version of TYPO3 CMS is affected by CVE-2026-15305?

CVE-2026-15305 affects versions of TYPO3 CMS that use the FileUpload or ImageUpload elements without proper server-side MIME type validation.

5

Is there a workaround for CVE-2026-15305?

A potential workaround for CVE-2026-15305 is to implement additional server-side checks for uploaded file types until an official patch is applied.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203