Listen to this Post
How CVE-2026-15305 Works
This vulnerability resides in the Form Framework (ext:form) of TYPO3 CMS. The core issue is a server-side validation bypass affecting FileUpload and ImageUpload form elements when `allowedMimeTypes` are configured. Under normal operation, the `MimeTypeValidator` is responsible for enforcing these MIME type restrictions. However, due to a flaw in the form building lifecycle, the validator is registered before the concrete form definition properties are applied. This registration timing error results in the validator never being added to the processing pipeline. Consequently, while the configuration suggests MIME type restrictions are in place, they are never actually enforced on the server-side, allowing users to upload files of arbitrary MIME types. It is important to note that uploading PHP files was not possible, but the bypass still creates a significant security gap by permitting other potentially dangerous file types to be uploaded. The affected versions are TYPO3 CMS 14.2.0 through 14.3.4. The vulnerability is categorized as CWE-351 (Insufficient Type Distinction) and has a CVSS v4.0 score of 6.3 (Medium severity). The issue was reported by Sébastien Convers and fixed by Josua Vogel and Oliver Hader.
DailyCVE Form:
Platform: TYPO3 CMS
Version: 14.2.0-14.3.4
Vulnerability: Validation Bypass
Severity: Medium (6.3)
date: July 14, 2026
Prediction: Already Patched (July 14, 2026)
What Undercode Say:
Analytics show exploitation attempts spiked post-disclosure. The validator timing flaw makes this a high-value target for attackers. Below are bash commands and related code snippets.
Check your TYPO3 version via CLI php typo3cms --version Check composer.json for affected version composer show typo3/cms-form | grep versions
// Vulnerable code context (simplified) // MimeTypeValidator registered too early, before form properties applied $validator = new MimeTypeValidator(); // ... form properties applied later, but validator is not re-registered
Exploit: (Educational Purposes!)
An attacker can craft a multipart/form-data request to a form containing a FileUpload element. By intercepting the upload request (e.g., with Burp Suite), the attacker can modify the `Content-Type` of the uploaded file to any MIME type, bypassing the client-side restrictions. Since the server-side `MimeTypeValidator` is never executed, the arbitrary MIME type is accepted and the file is stored. This could allow uploading of HTML files for XSS or other file types that may be processed maliciously by the server.
Example curl command to simulate an upload with arbitrary MIME type curl -X POST https://target-typo3.com/form/upload \ -F "[email protected];type=image/png"
Protection:
Immediately update to TYPO3 version 14.3.5 LTS or later. If immediate update is not possible, implement additional server-side validation layers or deploy a Web Application Firewall (WAF) with MIME type enforcement capabilities. Conduct a comprehensive security review of all file upload functionality.
Impact:
Successful exploitation allows attackers to bypass configured MIME type restrictions. This can lead to uploading malicious files that may enable cross-site scripting (XSS) attacks, or other malicious activities depending on how the uploaded files are processed within the application. The vulnerability undermines the security posture of TYPO3 CMS installations that rely on these MIME type controls.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
