Vulnerability Description
Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.
Related Weaknesses (CWE)
References
- https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a
- https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b
- https://typo3.org/security/advisory/typo3-core-sa-2026-020
FAQ
What is CVE-2026-15305?
CVE-2026-15305 is a documented vulnerability. Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the M...
How severe is CVE-2026-15305?
CVSS scoring is not yet available for CVE-2026-15305. Check NVD for updates.
Is there a patch for CVE-2026-15305?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.