Vulnerability · Published Jul 14, 2026 · Assigned by TYPO3

CVE-2026-15305TYPO3 CMS - Unrestricted File Upload in Form Framework

Medium 6.3

In plain English

A medium-severity security flaw in TYPO3 CMS from TYPO3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.3%top 83.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	typo3/cms-form	14.3.5	GHSA-mfqj-cqv3-h7xw

Affected products (as reported)

Vendor	Product	Versions
TYPO3	TYPO3 CMS	14.2.0 – before 14.3.5

Weakness: CWE-351 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

References

https://typo3.org/security/advisory/typo3-core-sa-2026-020 vendor-advisory
Git commit of main branch patch
Git commit of 14.3 branch patch