PT-2026-58011

CVE-2026-15305

Published

2026-07-14

Updated

2026-09-03

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 14.2.0 through 14.3.5

Description Users can upload files with arbitrary MIME types to forms utilizing FileUpload or ImageUpload elements that have allowedMimeTypes configured. This occurs because the MimeTypeValidator is registered during form building before concrete form definition properties are applied, which prevents the validator from being added to the processing pipeline and allows the server-side restriction to be bypassed.

Recommendations Update TYPO3 CMS to a version later than 14.3.5.

Exploitability

Exploit

Fix

Researchers

Josua Vogel

Oliver Hader

Vendors

Affected products

Weakness enumeration

CWE-351: Insufficient Type Distinction

Related identifiers