CVE-2026-15305 TYPO3 CMS - Unrestricted File Upload in Form Framework

🗓️ 14 Jul 2026 12:45:10Reported by TYPO3Type

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form bui...

Reporter	Title	Published	Views	Family All 6
ATTACKERKB	CVE-2026-15305	14 Jul 202612:45	–	attackerkb
CVE	CVE-2026-15305	14 Jul 202612:45	–	cve
EUVD	EUVD-2026-43671	14 Jul 202612:45	–	euvd
NVD	CVE-2026-15305	14 Jul 202613:18	–	nvd
Positive Technologies	PT-2026-58011	14 Jul 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-15305 TYPO3 CMS - Unrestricted File Upload in Form Framework	14 Jul 202612:45	–	vulnrichment

[
  {
    "vendor": "TYPO3",
    "product": "TYPO3 CMS",
    "collectionURL": "https://packagist.org",
    "packageName": "typo3/cms-form",
    "repo": "https://github.com/TYPO3/typo3",
    "modules": [
      "Form Framework"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "14.2.0",
        "lessThan": "14.3.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
typo3	www.typo3.org/security/advisory/typo3-core-sa-2026-020

14 Jul 2026 12:45Current

CVSS 46.3

CWE-351