{"id":"CVE-2026-15305","aliases":["GHSA-mfqj-cqv3-h7xw"],"title":"TYPO3 CMS - Unrestricted File Upload in Form Framework","summary":"TYPO3 CMS - Unrestricted File Upload in Form Framework","severity":"medium","cwe":["CWE-351"],"vendor":"typo3","product":"typo3/cms-form","ecosystem":"composer","affected":["typo3/cms-form >= 14.2.0, <= 14.3.4"],"patched":["typo3/cms-form 14.3.5"],"published":"2026-08-31","updated":"2026-08-31","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mfqj-cqv3-h7xw","references":[{"url":"https://github.com/TYPO3/typo3/security/advisories/GHSA-mfqj-cqv3-h7xw"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-15305"},{"url":"https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a"},{"url":"https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b"},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml"},{"url":"https://news.typo3.com/security/advisory/typo3-core-sa-2026-020"},{"url":"https://typo3.org/security/advisory/typo3-core-sa-2026-020"},{"url":"https://github.com/advisories/GHSA-mfqj-cqv3-h7xw"}],"tags":["ghsa","composer"],"epss":0.00254,"epssPercentile":0.17199,"ingestedAt":"2026-08-31T20:13:44.551Z","slug":"CVE-2026-15305","body":"## Overview\n\n### Problem\nUsers were able to upload files with arbitrary MIME types to forms using _FileUpload_ or _ImageUpload_ elements with _allowedMimeTypes_ configured - uploading PHP files was **not** possible. The restriction was not enforced server-side because the _MimeTypeValidator_ was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.\n\n### Solution\nUpdate to TYPO3 version 14.3.5 LTS that fixes the problem described.\n\n### Credits\nThanks to Sébastien Convers for reporting this issue, and to Josua Vogel and Oliver Hader for fixing it.\n\n## Affected packages\n\n- `typo3/cms-form >= 14.2.0, <= 14.3.4`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `typo3/cms-form 14.3.5`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}