What’s Vulnerable › Vulnerabilities

CVE-2026-15305: TYPO3 CMS - Unrestricted File Upload in Form Framework

• Severity: medium (CVSS 6.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-14 · updated 2026-10-24
• Weakness: CWE-351

Description

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

Affected products

• typo3: from 14.2.0 before 14.3.5 — fixed in 14.3.5

How to fix

Upgrade to a fixed version: typo3 14.3.5. Check the vendor advisory for mitigations.

References

• https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a
• https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b
• https://typo3.org/security/advisory/typo3-core-sa-2026-020

Get alerted when CVE-2026-15305 or the next vulnerability affects your stack