Josua Vogel

**Name of the Vulnerable Software and Affected Versions** TYPO3 CMS versions 14.2.0 through 14.3.5 **Description** Users can upload files with arbitrary MIME types to forms utilizing FileUpload or ImageUpload elements that have `allowedMimeTypes` configured. This occurs because the `MimeTypeValidator` is registered during form building before concrete form definition properties are applied, which prevents the validator from being added to the processing pipeline and allows the server-side restriction to be bypassed. **Recommendations** Update TYPO3 CMS to a version later than 14.3.5.