TYPO3 CMS Form Framework unrestricted file upload

Severity: medium · CVSS 6.3 · Published 2026-07-14

Executive brief

TYPO3 CMS includes a form framework that allows website administrators to build forms with file upload capabilities. When administrators configure form fields to restrict uploads to certain file types (such as PDFs only), this restriction was not enforced on the server side, allowing attackers to upload files of any MIME type. This could enable uploading and execution of malicious files, compromising website integrity.

Technical details

The vulnerability exists in TYPO3 CMS's form framework, affecting FileUpload and ImageUpload elements. The root cause is a timing issue in form building: FileUpload::initializeFormElement() attempted to register the MimeTypeValidator based on the "allowedMimeTypes" property, but this method is called before concrete form definition properties are applied. Since the prototype type definition lacks "allowedMimeTypes", the property is always empty at validator registration time, so the validator never enters the processing pipeline. Attackers can bypass the client-side "accept" attribute in the browser to submit files with arbitrary MIME types, which pass validation and are processed by form finishers. The fix (patched in 14.3.5) moves MimeTypeValidator registration to runtime in PropertyMappingConfiguration::adjustPropertyMappingForFileUploadsAtRuntime(), where form properties are fully available and validation occurs before submission is processed. The attack requires network access and the ability to submit a form, but no authentication or user interaction beyond form submission is needed.

TYPO3 CMS Form Framework unrestricted file upload

Executive brief

Technical details

Affected products

Timeline

References

Related threats