EUVD-2026-43671
GHSA-mfqj-cqv3-h7xw
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible public form, no credentials needed, no scope change; integrity impact is low (unrestricted file type stored), no confidentiality or availability impact confirmed.
Primary rating from Vendor (f4fb688c-4412-4426-b4b8-421ecf27b14a).
CVSS VectorVendor: f4fb688c-4412-4426-b4b8-421ecf27b14a
Lifecycle Timeline
2DescriptionCVE.org
Users were able to upload files with arbitrary MIME types to forms using FileUpload or ImageUpload elements with allowedMimeTypes configured. The restriction was not enforced server-side because the MimeTypeValidator was registered during form building before concrete form definition properties were applied, resulting in the validator never being added to the processing pipeline. This issue affects TYPO3 CMS versions 14.2.0-14.3.5.
AnalysisAI
MIME type restriction bypass in TYPO3 CMS 14.2.0-14.3.5 allows unauthenticated attackers to upload files of arbitrary MIME types through forms configured with FileUpload or ImageUpload elements, circumventing the allowedMimeTypes restriction entirely. The flaw originates from a lifecycle ordering defect in the server-side form framework: MimeTypeValidator is registered before concrete form definition properties are applied, so it is absent from the validation pipeline at runtime. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the network-accessible, zero-prerequisite-auth nature of the bypass elevates practical risk wherever affected forms are publicly exposed.
Technical ContextAI
TYPO3 CMS is a PHP-based enterprise content management system with a flexible Form Framework that supports dynamic form element types including FileUpload and ImageUpload. These elements expose an allowedMimeTypes configuration property that is intended to enforce server-side MIME type validation via MimeTypeValidator. The root cause (CWE-351: Insufficient Type Distinction) is a form-builder lifecycle ordering bug: the MimeTypeValidator is instantiated and registered during initial form construction, before the concrete form definition properties (including the allowedMimeTypes list) are merged into the element. As a result, the validator object exists but without the required type constraints, and is effectively inert in the processing pipeline. The affected CPE covers TYPO3 core versions 14.2.0 through 14.3.5. Client-side MIME type checks remain in place but provide no meaningful security barrier.
RemediationAI
The primary remediation is to upgrade TYPO3 CMS to a version beyond 14.3.5; the exact patched release version is not independently confirmed from available data - consult the vendor advisory at https://typo3.org/security/advisory/typo3-core-sa-2026-020 for the authoritative fix version. If an immediate upgrade is not possible, a compensating control is to disable or remove any public-facing forms that include FileUpload or ImageUpload elements; this eliminates the attack surface entirely but may disrupt legitimate user workflows. Alternatively, operators can route form submissions through a server-side reverse proxy or WAF rule that enforces MIME type restrictions at the network boundary - note that MIME type headers can be spoofed, so content-sniffing inspection (e.g., libmagic-based) is preferable to header-only filtering. Do not rely on client-side MIME validation as a security control.
Same weakness CWE-351 – Insufficient Type Distinction
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today