CVE-2026-15305

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a
https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b
https://typo3.org/security/advisory/typo3-core-sa-2026-020

Configurations

No configuration.

History

24 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Los usuarios pudieron subir archivos con tipos MIME arbitrarios a formularios usando elementos FileUpload o ImageUpload con allowedMimeTypes configurados. La restricción no se aplicó en el lado del servidor porque el MimeTypeValidator se registró durante la construcción del formulario antes de que se aplicaran las propiedades concretas de definición del formulario, lo que resultó en que el validador nunca se añadiera a la tubería de procesamiento. Este problema afecta a las versiones 14.2.0-14.3.4 de TYPO3 CMS.

Information

Published : 2026-07-14 13:18

Updated : 2026-10-24 21:10

NVD link : CVE-2026-15305

Mitre link : CVE-2026-15305

CVE.ORG link : CVE-2026-15305

JSON object : View

Products Affected

No product.

CWE

CWE-351

Insufficient Type Distinction

{"id": "CVE-2026-15305", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15305", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T13:26:13.647808Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "affectedData": [{"repo": "https://github.com/TYPO3/typo3", "vendor": "TYPO3", "modules": ["Form Framework"], "product": "TYPO3 CMS", "versions": [{"status": "affected", "version": "14.2.0", "lessThan": "14.3.5", "versionType": "semver"}], "packageName": "typo3/cms-form", "collectionURL": "https://packagist.org", "defaultStatus": "unaffected"}]}], "published": "2026-07-14T13:18:16.270", "references": [{"url": "https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}, {"url": "https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}, {"url": "https://typo3.org/security/advisory/typo3-core-sa-2026-020", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "f4fb688c-4412-4426-b4b8-421ecf27b14a", "description": [{"lang": "en", "value": "CWE-351"}]}], "descriptions": [{"lang": "en", "value": "Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4."}, {"lang": "es", "value": "Los usuarios pudieron subir archivos con tipos MIME arbitrarios a formularios usando elementos FileUpload o ImageUpload con allowedMimeTypes configurados. La restricci\u00f3n no se aplic\u00f3 en el lado del servidor porque el MimeTypeValidator se registr\u00f3 durante la construcci\u00f3n del formulario antes de que se aplicaran las propiedades concretas de definici\u00f3n del formulario, lo que result\u00f3 en que el validador nunca se a\u00f1adiera a la tuber\u00eda de procesamiento. Este problema afecta a las versiones 14.2.0-14.3.4 de TYPO3 CMS."}], "lastModified": "2026-10-24T21:10:00.130", "sourceIdentifier": "f4fb688c-4412-4426-b4b8-421ecf27b14a"}