TYPO3 CMS CVE-2026-15305

Exploitation requires that the target TYPO3 instance runs version 14.2.0-14.3.5 AND has at least one form deployed via the TYPO3 Form Framework that includes a FileUpload or ImageUpload form element with the allowedMimeTypes property explicitly set to a non-empty list. The CVSS 4.0 vector (PR:N/UI:N) indicates no authentication or user interaction is required to submit to the form, meaning any publicly accessible form meeting the above criteria is exploitable without credentials. What limits exploitation: the AT:P metric confirms the target-specific condition (forms with allowedMimeTypes configured); sites using only text or non-file form elements are not affected; sites not using the TYPO3 Form Framework at all are unaffected; and the actual impact of a successful upload depends on downstream file handling - if uploaded files are stored but never rendered or executed, integrity impact is minimal.

The vendor-supplied CVSS 4.0 score is 6.3 (Medium) with vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L. The AT:P (Attack Requirements: Present) metric correctly captures that exploitation requires a deployed form with FileUpload or ImageUpload elements and a non-empty allowedMimeTypes configuration - this is a non-default, intentional administrator choice, which limits the exposed surface. No EPSS data was provided, no CISA KEV listing exists, and no POC has been publicly identified, all of which pull real-world risk downward from the headline score. However, the practical danger depends heavily on what downstream processing occurs with uploaded files: if the application or a connected system renders, parses, or executes uploaded content, a MIME bypass becomes a significant vector for stored XSS, SSRF, or secondary code execution. The 'Information Disclosure' tag in the intelligence feed appears inconsistent with the described impact, which is primarily an integrity bypass; this discrepancy should be verified against the vendor advisory. Overall this is a medium-priority issue requiring prompt patching for sites with public file upload forms, but not an emergency response item absent evidence of active exploitation.

An attacker visits a publicly accessible TYPO3 site that hosts a contact or registration form with a file upload field restricted to images (e.g., allowedMimeTypes: image/jpeg, image/png). Using a tool such as curl or Burp Suite, they intercept the multipart/form-data request and replace the Content-Type header and file content with an HTML or SVG file containing embedded JavaScript, then submit the form. Because MimeTypeValidator is absent from the server-side pipeline, the upload succeeds; if the uploaded file is later rendered in a browser context - for example, as an attachment preview or accessible via a direct URL - a stored XSS payload executes against site visitors or administrators.