CVE-2026-15305

6.3 Moyenne

Publiée le 14/07/2026 à 15:18 · Modifiée le 03/09/2026 à 06:15 · Analyse NVD reportée · Source : f4fb688c-4412-4426-b4b8-421ecf27b14a

Description

Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.4.

Traduire en français

Produits concernés

TYPO3 CMS

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.3 Moyenne	f4fb688c-4412-4426-b4b8-421ecf27b14a	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-351

Références

https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a
https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b
https://typo3.org/security/advisory/typo3-core-sa-2026-020

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories