TYPO3 CMS - Unrestricted File Upload in Form Framework — GHSA-MFQJ-CQV3-H7XW

Summary

### Problem Users were able to upload files with arbitrary MIME types to forms using _FileUpload_ or _ImageUpload_ elements with _allowedMimeTypes_ configured - uploading PHP files was **not** possible. The restriction was not enforced server-side because the _MimeTypeValidator_ was registered during form building before concrete form definition properties were applied, resulting in the validator never being added…

Timeline

Published by source

2026-08-31

Risk context

• Reported severity or threat level: medium.
• Reported CVSS score: 6.3 out of 10.
• Reported EPSS value: 0.00254.
• Review exposure for the affected product or family: composer: typo3/cms-form.

Product

composer: typo3/cms-form

What to do

General, cautious steps (verify details in the official source):

• Review exposure and plan remediation based on risk and environment.
• Identify affected product versions in your inventory and verify whether you are impacted.
• Apply vendor patches/updates or recommended mitigations as soon as available.
• Read the official advisory for exact affected versions and remediation steps.

Official advisory

• Read the official source
• CVE Record
• NVD

Evidence and provenance

Canonical advisory ID

GHSA-MFQJ-CQV3-H7XW

Source

GitHub

Vendor

GitHub

Published by source

2026-08-31

Last source activity

2026-08-31

Additional identifiers

CVE-2026-15305

Curated by

hlukh.ch

Related advisories and connections

These advisories are connected by shared CVE, product, vendor, source, or time signals.