{"id":"CVE-2026-15305","aliases":["GHSA-mfqj-cqv3-h7xw"],"url":"https://o3.security/vulnerability/CVE-2026-15305","summary":"TYPO3 CMS - Unrestricted File Upload in Form Framework","details":"### Problem\nUsers were able to upload files with arbitrary MIME types to forms using _FileUpload_ or _ImageUpload_ elements with _allowedMimeTypes_ configured - uploading PHP files was **not** possible. The restriction was not enforced server-side because the _MimeTypeValidator_ was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.\n\n### Solution\nUpdate to TYPO3 version 14.3.5 LTS that fixes the problem described.\n\n### Credits\nThanks to Sébastien Convers for reporting this issue, and to Josua Vogel and Oliver Hader for fixing it.","published":"2026-07-14T12:45:10.996Z","modified":"2026-10-21T02:56:11.585913982Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"typo3/cms-form","fixedVersion":"14.3.5"}],"fix":{"url":"https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a","label":"TYPO3/typo3@817ad41"},"references":[{"type":"WEB","url":"https://packagist.org"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15305.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15305"},{"type":"ADVISORY","url":"https://typo3.org/security/advisory/typo3-core-sa-2026-020"},{"type":"FIX","url":"https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a"},{"type":"FIX","url":"https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b"},{"type":"PACKAGE","url":"https://github.com/TYPO3/typo3"},{"type":"WEB","url":"https://github.com/TYPO3/typo3/security/advisories/GHSA-mfqj-cqv3-h7xw"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml"},{"type":"WEB","url":"https://news.typo3.com/security/advisory/typo3-core-sa-2026-020"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:56:11.585913982Z"}}