CVE-2026-15305 TYPO3 CVE debrief

Who should care

TYPO3 CMS administrators and users, security teams responsible for web application security, and operators of TYPO3 CMS installations should be aware of this vulnerability and take necessary actions to mitigate it. This includes reviewing and updating TYPO3 CMS to version 14.3.5 or later, restricting file uploads to only allow specific MIME types, and implementing additional validation and sanitization for uploaded files. Platform and vulnerability-management teams should also review the affected scope and severity of this vulnerability and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Monitoring, detection, and logs for exposed assets should be checked for extra review. Exceptions, retesting of remediated assets, and closing the item only after evidence is documented are also important steps to take. Asset inventory and source tracking can help with this process. Rolling back change windows and implementing additional security measures can also be considered. The CVE record was published on 2026-07-14T13:18:16.270Z and has not been modified since then, so it is essential to act quickly to address this vulnerability. Security teams should prioritize this vulnerability based on its CVSS score of 6.3 and potential for arbitrary file uploads. Affected operators and platforms should also be aware of the potential risks and take necessary precautions to prevent exploitation. Overall, a comprehensive review of the affected systems and implementation of necessary mitigations is crucial to addressing this vulnerability effectively. Security teams should also consider the potential impact on their organization's web application security and take steps to prevent similar vulnerabilities in the future. By taking these steps, organizations can help prevent exploitation of this vulnerability and protect their systems from potential attacks. It is essential to stay informed about the latest developments and updates related to this vulnerability and to implement the recommended actions to mitigate its impact. The de

Technical summary

The vulnerability is caused by the MimeTypeValidator being registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This allows users to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The issue affects TYPO3 CMS versions 14.2.0-14.3.4. To mitigate this vulnerability, administrators should review and update TYPO3 CMS to version 14.3.5 or later, restrict file uploads to only allow specific MIME types, and implement additional validation and sanitization for uploaded files.

Defensive priority

Medium-priority defensive review recommended due to the CVSS score of 6.3 and potential for arbitrary file uploads.

Recommended defensive actions

• Review and update TYPO3 CMS to version 14.3.5 or later
• Restrict file uploads to only allow specific MIME types
• Implement additional validation and sanitization for uploaded files
• Monitor for suspicious file upload activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue affects TYPO3 CMS versions 14.2.0-14.3.4. Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.