Read the docs
TI-2026-12881 Aliases CVE-2026-15305GHSA-mfqj-cqv3-h7xw

TYPO3 CMS - Unrestricted File Upload in Form Framework

Priority LOW 28CWE-351Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00254 17th percentileScored 2026-11-07
Fix Fixed TYPO3 CMS (TYPO3): 14.3.5typo3/cms-form (Packagist): 14.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TYPO3TYPO3 CMS14.2.0 to before 14.3.514.3.5Patch availableCNA
—typo3/cms-form (Packagist)14.2.0 to before 14.3.514.3.5Patch availableGHSA-mfqj-cqv3-h7xw
  • TYPO3 CMS VendorTYPO3 Affected 14.2.0 to before 14.3.5 Fixed in 14.3.5 Patch available CNA
  • typo3/cms-form (Packagist) Vendor— Affected 14.2.0 to before 14.3.5 Fixed in 14.3.5 Patch available GHSA-mfqj-cqv3-h7xw

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*——TYPO3
  • cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:* Versions — — ·TYPO3

Remediation

  • Fix · CNA TYPO3 CMS (TYPO3) Fixed in 14.3.5
  • Fix · GHSA-mfqj-cqv3-h7xw typo3/cms-form (Packagist) Fixed in 14.3.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15305
  2. 2026-10-03 Alias added: GHSA-mfqj-cqv3-h7xw

References

Patch 2

Advisory 2

Other 4

  • TI-2023-10314 Persisted Cross-Site Scripting in Frontend Rendering in typo3 CVSS 3.1HIGH 8.8
  • TI-2010-03538 The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3… CVSS 2.0HIGH 7.1
  • TI-2009-00775 The jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before… CVSS 2.0MEDIUM 5.0
  • TI-2025-30547 The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. CVSS 3.1CRITICAL 10.0
  • TI-2019-08867 The PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before… CVSS 3.1CRITICAL 9.8
  • TI-2008-04019 Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before… CVSS 2.0HIGH 10.0
See all 411 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences