CVE-2026-15305

Published: Jul 14, 2026Modified: Jul 15, 2026Deferred

6.3

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: f4fb688c-4412-4426-b4b8-421ecf27b14a (Secondary)

Description

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

Related CWEs

CWE-351

Insufficient Type Distinction

The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.

References (3)

https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a

Source: f4fb688c-4412-4426-b4b8-421ecf27b14a

https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b

Source: f4fb688c-4412-4426-b4b8-421ecf27b14a

https://typo3.org/security/advisory/typo3-core-sa-2026-020

Source: f4fb688c-4412-4426-b4b8-421ecf27b14a

Timeline

No history available yet.