# TYPO3 CMS Form Framework unrestricted file upload

Source: https://junglewise.ai/threats/typo3-cms-form-framework-unrestricted-file-upload-4ceedc0d  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.3 · Published 2026-07-14

TYPO3 CMS includes a form framework that allows website administrators to build forms with file upload capabilities. When administrators configure form fields to restrict uploads to certain file types (such as PDFs only), this restriction was not enforced on the server side, allowing attackers to upload files of any MIME type. This could enable uploading and execution of malicious files, compromising website integrity.

Technologies: [typo3/cms-form (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-form). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.3, published 14 July 2026.

**Which products and versions are affected?** typo3/cms-form (Packagist) >= 14.2.0, < 14.3.5.

**Is there a fix for This vulnerability?** A patch was published on 2026-07-14: Fix released in TYPO3 CMS 14.3.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run typo3/cms-form (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in TYPO3 CMS's form framework, affecting FileUpload and ImageUpload elements. The root cause is a timing issue in form building: FileUpload::initializeFormElement() attempted to register the MimeTypeValidator based on the "allowedMimeTypes" property, but this method is called before concrete form definition properties are applied. Since the prototype type definition lacks "allowedMimeTypes", the property is always empty at validator registration time, so the validator never enters the processing pipeline. Attackers can bypass the client-side "accept" attribute in the browser to submit files with arbitrary MIME types, which pass validation and are processed by form finishers. The fix (patched in 14.3.5) moves MimeTypeValidator registration to runtime in PropertyMappingConfiguration::adjustPropertyMappingForFileUploadsAtRuntime(), where form properties are fully available and validation occurs before submission is processed. The attack requires network access and the ability to submit a form, but no authentication or user interaction beyond form submission is needed.

## Affected products

- TYPO3 TYPO3 CMS (cms-form) 14.2.0 to 14.3.4

## Timeline

- 2026-07-14: disclosed: TYPO3-CORE-SA-2026-020 published
- 2026-07-14: patched: Fix released in TYPO3 CMS 14.3.5

## References

- [https://typo3.org/security/advisory/typo3-core-sa-2026-020](https://typo3.org/security/advisory/typo3-core-sa-2026-020)
- [https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a](https://github.com/TYPO3/typo3/commit/817ad41cc9dd28aac0fc4d0fe16fc25d46dd554a)
- [https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b](https://github.com/TYPO3/typo3/commit/cfda21050398eb145211a4fa6f9988f10e43e10b)
- [https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml](https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-form/CVE-2026-15305.yaml)
- [https://news.typo3.com/security/advisory/typo3-core-sa-2026-020](https://news.typo3.com/security/advisory/typo3-core-sa-2026-020)

## Related threats

- [TYPO3 CMS unrestricted file upload in Form Framework](https://junglewise.ai/threats/cve-2026-15305-typo3-cms-unrestricted-file-upload-in-form-framework)
- [TYPO3 CMS broken access control in Form Framework form_definition table](https://junglewise.ai/threats/cve-2026-49741-typo3-cms-broken-access-control-in-form-framework-form-definition)
- [TYPO3 CMS privilege escalation in Form Framework via mixed-case extensions](https://junglewise.ai/threats/cve-2026-47346-typo3-cms-privilege-escalation-in-form-framework-via-mixed-case)
- [TYPO3 CMS privilege escalation in Form Framework](https://junglewise.ai/threats/cve-2026-11607-typo3-cms-privilege-escalation-in-form-framework)
- [TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery](https://junglewise.ai/threats/cve-2024-55922-typo3-form-framework-module-vulnerable-to-cross-site-request)