CVE-2026-15305
Medium
Description
Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.
SeverityMedium
CVSS6.3
Exploit probability—
ProductTypo3/cms-form
PublishedJul 14, 2026
First seenJul 14, 2026
Weakness typeCWE-351CWE-351
How to fix
Update
- typo3/cms-form14.3.5 or later
Patches
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| typo3/cms-formPackagist | 14.2.0 ≤ v < 14.3.5 | 14.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.