CVE-2026-15305

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-15305

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15305.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-15305

Published

2026-07-14T12:45:10.996Z

Modified

2026-07-17T03:45:47.663494728Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

TYPO3 CMS - Unrestricted File Upload in Form Framework

Details

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

Database specific

{
    "cwe_ids": [
        "CWE-351"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/15xxx/CVE-2026-15305.json",
    "cna_assigner": "TYPO3"
}

References

Affected packages

Git / github.com/typo3/typo3

Affected ranges

Type

GIT

Repo

https://github.com/typo3/typo3

Events

Introduced

cfda1147fba7bb5bbe30cf5aedd3277a0a329b3e

Fixed

817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a

Fixed

cfda21050398eb145211a4fa6f9988f10e43e10b

Database specific

{
    "extracted_events": [
        {
            "introduced": "14.2.0"
        },
        {
            "fixed": "14.3.5"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v14.*

v14.2.0

v14.3.0

v14.3.1

v14.3.2

v14.3.3

v14.3.4

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-15305.json"