---
id: CVE-2026-15305
aliases:
  - GHSA-mfqj-cqv3-h7xw
title: TYPO3 CMS - Unrestricted File Upload in Form Framework
summary: TYPO3 CMS - Unrestricted File Upload in Form Framework
severity: medium
cwe:
  - CWE-351
vendor: typo3
product: typo3/cms-form
ecosystem: composer
affected:
  - 'typo3/cms-form >= 14.2.0, <= 14.3.4'
patched:
  - typo3/cms-form 14.3.5
published: '2026-08-31'
updated: '2026-08-31'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-mfqj-cqv3-h7xw'
references:
  - url: 'https://github.com/TYPO3/typo3/security/advisories/GHSA-mfqj-cqv3-h7xw'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15305'
  - url: >-
      https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a
  - url: >-
      https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b
  - url: >-
      https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml
  - url: 'https://news.typo3.com/security/advisory/typo3-core-sa-2026-020'
  - url: 'https://typo3.org/security/advisory/typo3-core-sa-2026-020'
  - url: 'https://github.com/advisories/GHSA-mfqj-cqv3-h7xw'
tags:
  - ghsa
  - composer
epss: 0.00254
epssPercentile: 0.15099
ingestedAt: '2026-08-31T20:13:44.551Z'
---

## Overview

### Problem
Users were able to upload files with arbitrary MIME types to forms using _FileUpload_ or _ImageUpload_ elements with _allowedMimeTypes_ configured - uploading PHP files was **not** possible. The restriction was not enforced server-side because the _MimeTypeValidator_ was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.

### Solution
Update to TYPO3 version 14.3.5 LTS that fixes the problem described.

### Credits
Thanks to Sébastien Convers for reporting this issue, and to Josua Vogel and Oliver Hader for fixing it.

## Affected packages

- `typo3/cms-form >= 14.2.0, <= 14.3.4`

## Remediation

Upgrade to a patched release:

- `typo3/cms-form 14.3.5`