CVE-2026-15305 Details
Description
Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.
A vulnerability exists in TYPO3 CMS versions 14.2.0 prior to 14.3.5, allowing users to upload files with arbitrary MIME types through forms that include FileUpload or ImageUpload elements with specified allowedMimeTypes. The server-side restriction was not properly enforced because the MimeTypeValidator was applied during the initial form building stage, before the specific form properties were set, leading to the validator being excluded from the processing pipeline. Consequently, this flaw enabled unrestricted file uploads, although uploading PHP files was not possible.
Users are advised to update TYPO3 to version 14.3.5 LTS, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 14, 2026CISA-ADP
Assessed Jul 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a | TYPO3 | |
| https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b | TYPO3 | |
| https://typo3.org/security/advisory/typo3-core-sa-2026-020 | TYPO3 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-351 | Insufficient Type Distinction | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 | >= 14.2.0, <= 14.3.4 (semver) |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 3, 2026 | CVE Modified | TYPO3 |
| Sep 3, 2026 | CVE Modified | CISA-ADP |
| Jul 15, 2026 | CVE Modified | TYPO3 |
| Jul 15, 2026 | CVE Modified | TYPO3 |
| Jul 14, 2026 | CVE Modified | CISA-ADP |
| Jul 14, 2026 | New CVE Received | TYPO3 |