CVE-2026-15305: TYPO3 CMS File Upload Vulnerability

CVE-2026-15305 Overview

CVE-2026-15305 is a MIME type validation bypass in TYPO3 CMS affecting forms that use FileUpload or ImageUpload elements with allowedMimeTypes configured. The MimeTypeValidator was registered during form building before concrete form definition properties were applied. As a result, the validator was never added to the processing pipeline, and clients could submit files with arbitrary MIME types. The flaw is tracked under CWE-351: Insufficient Type Distinction and affects TYPO3 CMS versions 14.2.0 through 14.3.4.

Critical Impact
Attackers can upload files with disallowed MIME types to any TYPO3 form using FileUpload or ImageUpload, enabling delivery of unexpected content to backend storage and downstream consumers.

Affected Products

TYPO3 CMS 14.2.0 through 14.3.4
Forms using FileUpload element with allowedMimeTypes configuration
Forms using ImageUpload element with allowedMimeTypes configuration

Discovery Timeline

2026-07-14 - CVE-2026-15305 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15305

Vulnerability Analysis

The vulnerability originates in the TYPO3 Form framework's initialization order. The MimeTypeValidator is intended to enforce the allowedMimeTypes restriction server-side for FileUpload and ImageUpload elements. During form construction, the validator was registered before concrete form definition properties were resolved. Because the properties containing allowedMimeTypes were unavailable at registration time, the validator was never wired into the processing pipeline that runs during form submission.

The effect is a silent bypass. Server-side enforcement is absent even though the form definition explicitly configures the restriction. Attackers do not need to defeat the check because it never executes. Any MIME type can be submitted and accepted for downstream processing by the form runtime.

Root Cause

The defect is a sequencing bug in form element construction. The registration path for MimeTypeValidator executed before the runtime applied the concrete form definition, so the validator instance was created without the configured allowedMimeTypes and dropped from the validator chain in ProcessingRule.

Attack Vector

Exploitation requires no authentication and no user interaction. An attacker submits a multipart form request to a public TYPO3 form that exposes a FileUpload or ImageUpload element and includes a file with a MIME type outside the configured allow list. The server accepts the upload because the validator is not present in the processing chain.

php

// Patch excerpt: typo3/sysext/form/Classes/Domain/Model/FormElements/FileUpload.php
 use TYPO3\CMS\Core\Utility\GeneralUtility;
 use TYPO3\CMS\Core\Utility\PathUtility;
 use TYPO3\CMS\Extbase\Domain\Model\FileReference;
-use TYPO3\CMS\Extbase\Persistence\ObjectStorage;
-use TYPO3\CMS\Extbase\Validation\ValidatorResolver;
 use TYPO3\CMS\Form\Mvc\Property\TypeConverter\UploadedFileReferenceConverter;
-use TYPO3\CMS\Form\Mvc\Validation\MimeTypeValidator;

 // Patch excerpt: typo3/sysext/form/Classes/Mvc/ProcessingRule.php
         $messages = GeneralUtility::makeInstance(Result::class);
         }

+        // PropertyMapper::convert() already records the TypeConverter's Error in
+        // $messages (via doMapping()) and returns null. If errors are present at
+        // this point, running validators on a null value would add spurious errors
+        // that mask the real rejection reason — skip them.
+        if ($messages->hasErrors()) {
+            $this->processingMessages->merge($messages);
+            return $value;
+        }

Source: TYPO3 commit 817ad41c and TYPO3 commit cfda2105. The fix removes the build-time registration path and registers the MimeTypeValidator at runtime, after form definition properties are applied. It also short-circuits ProcessingRule when the type conversion step already produced errors, preventing spurious validation results on null values.

Detection Methods for CVE-2026-15305

Indicators of Compromise

Uploaded files stored in TYPO3 form upload directories with MIME types or extensions that do not match the allowedMimeTypes configured for the form.
HTTP POST requests to TYPO3 form endpoints containing multipart/form-data payloads with executable or script content types such as application/x-php, application/x-httpd-php, or text/html.
Web server access logs showing successful 200 or 302 responses to form submissions followed by requests to newly written files in upload paths.

Detection Strategies

Inspect stored uploads under fileadmin/ and configured form upload storages and compare each file's detected MIME type against the corresponding form's allowedMimeTypes setting.
Enable and review TYPO3 system logs for form submissions and correlate submitted file types with declared form configuration.
Deploy web application firewall rules that inspect Content-Type parts inside multipart requests to TYPO3 form endpoints.

Monitoring Recommendations

Monitor file creation events in TYPO3 upload directories and alert on unexpected file extensions such as .php, .phtml, .phar, .html, or .svg where those types are not allowed.
Track outbound requests to form processing URLs and flag high-frequency multipart submissions from single source addresses.
Audit installed TYPO3 core version across estate and identify systems running 14.2.0 through 14.3.4.

How to Mitigate CVE-2026-15305

Immediate Actions Required

Upgrade TYPO3 CMS to a version that includes the fix from commits 817ad41c and cfda2105, as directed by TYPO3 Core Security Advisory TYPO3-CORE-SA-2026-020.
Audit existing uploads in all form storages and quarantine files whose MIME types are outside the intended allow list.
Restrict web server execution in TYPO3 upload directories so that stored files cannot be executed as scripts.

Patch Information

TYPO3 has published fixes for CVE-2026-15305 under TYPO3-CORE-SA-2026-020. The patch relocates MimeTypeValidator registration to runtime inside FileUpload.php and updates ProcessingRule.php to skip validator execution when the type converter has already produced errors. Administrators should apply the vendor-supplied release covering TYPO3 CMS 14.2.0 through 14.3.4.

Workarounds

Disable FileUpload and ImageUpload elements in publicly reachable forms until the patched version is deployed.
Configure web server rules to reject multipart uploads with MIME types outside the intended allow list at the reverse proxy or WAF layer.
Enforce non-execution on upload storage directories by setting appropriate handler configuration in the web server.

bash

# Apache: prevent script execution in TYPO3 upload storage
<Directory "/var/www/typo3/public/fileadmin">
    php_admin_flag engine off
    SetHandler none
    RemoveHandler .php .phtml .phar
    Options -ExecCGI
</Directory>

# Composer: upgrade TYPO3 core once the fixed release is available
composer require typo3/cms-core:"^14.3.5" --update-with-dependencies